Cross-site scripting (ARCH319)

Key dotnet.security.xss · Severity error · Category security · CWE CWE-79

Rendering user-controlled content without encoding lets an attacker inject script (XSS). Let Razor encode by default.

Incorrect

@Html.Raw(Model.UserComment)

Correct

@Model.UserComment  @* Razor HTML-encodes by default *@

Fix

Remove Html.Raw/HtmlString and rely on default encoding; if raw HTML is truly required, run the input through an HTML sanitizer first.