Is the standard HTML encoding HTML.DisplayTextFor () without HTML?

Question

We are currently dealing with some XSS issues in one of our ASP.NET MVC projects. I found two questions - the first one concerns the query validation pattern. An attacker can now use this security hole to remove bad content in our database.

The second problem is how we display this content, and we use the Html.DisplayTextFor method, and it seems “broken”.

Just create a new MVC 3 WebApp, put it in the HomeController:

public class HomeController : Controller { public ActionResult Index() { ViewBag.Message = "<SCRIPT/XSS SRC=\"htpp://ha.ckers.org/css.js\">"; User foo = new User(); foo.Name = "<SCRIPT/XSS SRC=\"htpp://ha.ckers.org/css.js\">"; return View(bla); } public ActionResult About() { return View(); } } public class User { public string Name { get; set; } } 

View:

 @Html.TextBoxFor(m => m.Name) <br/> ||| <-- will be encoded @Html.Encode(ViewBag.Message)<br/> ||| <-- will be double encoded @Model.Name <br/> ||| <-- will be encoded @Html.DisplayTextFor(m => m.Name) <-- no encoding <br/> ||| 

DisplayTextFor output will be the whole line <script xss="" src="htpp://ha.ckers.org/css.js">

Question: error, function, or am I using it incorrectly?

Answer 1

Html.DisplayTextFor valid for interacting with the [DisplayFormat] attribute ( see MSDN ).

So, if you use it with unsafe values, you should be aware of this and use [DisplayFormat(HtmlEncode = true)] for your property.

Edit: It looks like the HtmlEncode property is not actually applied by DataAnnotationsModelMetadataProvider (and DisplayTextFor).