How to prevent Arabic characters from recoding AntiXssEncoder?

Question

We use the System.Web.Security.AntiXss.AntiXssEncoder class provided by the .NET Framework (we target the .NET Framework 4.5.2) in our application, but we encounter problems with fields containing Arabic characters.

The following console application demonstrates the problem that we have:

using System;
using System.Collections.Generic;
using System.Web.Security.AntiXss;

namespace EncodingTest
{
    class Program
    {
        static void Main(string[] args)
        {
            var source = new List<string> { "Hello World", "على", "blöd", "&#1575;&#1604;&#1605;" };

            foreach (var testString in source)
            {
                var antiXssEncoded = AntiXssEncoder.HtmlEncode(testString, false);
                Console.WriteLine($"{testString} => {antiXssEncoded}");

                Console.WriteLine();
            }

            Console.ReadKey();
        }
    }
}

Arabic characters in the second element of the list are correctly encoded, but if the already encoded characters in the fourth element are transmitted through the encoder, then the '&' characters are encoded a second time in &, which is then displayed incorrectly on the web page.

This output from the application shows this (Unencoded Arab characters appear as "???" in the console):

Hello World => Hello World

??? => على

blöd => blöd

الم => الم

Is there any way to prevent this?

, - . , , .

, , , ; , , , . , , - , , , .

ا ا, - ?

Answer 1

, .

, HtmlEncode, HTML , . , & ( ) . . - "use '&' to represent '&' in HTML", "use '&' to represent '&' in HTML" HTML.

:

, , . , HTML . url ( % -encoding like ?q=search%20alot) JavaScript (, I said \"Hi Matt\"\nin this is long & winded post).

, , , , (.. ). , : " , ", " HTML, ", " HTML, , ", " , JavaScript ( \n)".

" HTML, HtmlEncode" - HTML (XSS). , , - , .

, HtmlEncode , HTML - . ASP.Net MVC, @Model.Text .

, HtmlString " HTML-, HTML ". HtmlEncode / HtmlString, , .