Cross-site scripting (ARCH319)
Ce contenu n’est pas encore disponible dans votre langue.
Key dotnet.security.xss · Severity error · Category security · CWE CWE-79
Rendering user-controlled content without encoding lets an attacker inject script (XSS). Let Razor encode by default.
Incorrect
Section titled “Incorrect”@Html.Raw(Model.UserComment)Correct
Section titled “Correct”@Model.UserComment @* Razor HTML-encodes by default *@Remove Html.Raw/HtmlString and rely on default encoding; if raw HTML is truly required, run the input through an HTML sanitizer first.