Blocking XSS and allow & and # in asp.net mvc application input fields

Question

My asp.net mvc application uses angujar js has following regular expression to block XSS data in the input fields.

^[^&<>\\\\\"'{}=#]*$

But the problem is, most of my customer data has & and # and it cannot be corrected. Please explain the best possible way to allow these two characters and still block XSS attacks.

EDIT 1 Can I try something like this, suppose if I allow & and # and add validation in such a way that only one & is allowed or only one # is allowed and either & or # are allowed but not both and restrict if these characters are more than once. I will place this validation on both client and server side. Is this a good approach ?

This is added in our code to throw the error when user enters these characters, its basically used in javascript for validation. — Harsha
– Harsha, Commented Jun 30, 2016 at 17:41
Client side input validation does not block XSS attacks. Unless you replicate that check on the asp.net side, you are still vulnerable regardless. — Erlend
– Erlend, Commented Jul 1, 2016 at 10:34
There really is no danger allowing any of those characters, as long as you do proper output encoding. Angular.js will do that for it's templates as long as you don't mix server side and client side templates (mentioned in the angular security doc). Templates should be static, and content should be delivered as JSON services. Most of the XSS vulnerabilities I have seen in angular apps, have been in those corner cases where this pattern is not followed — Erlend
– Erlend, Commented Jul 8, 2016 at 8:35

Pranay Rana · Accepted Answer · 2016-06-30 05:22:15Z

0

Best way to avoid this is not allowing # when entering new data. That means you can allow to display # by removing # from regular expression, but do not allow to type # by handling key press event of textbox.

answered Jun 30, 2016 at 5:22

Pranay Rana

177k37 gold badges244 silver badges266 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Harsha Over a year ago

Your point looks valid, I am displaying these characters in the UI now, but my requirement is to allow them to be sent back to the submitted in the form and sent back to database.

Collectives™ on Stack Overflow

Blocking XSS and allow & and # in asp.net mvc application input fields

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related