-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
11 changed files
with
215 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Text; | ||
|
|
||
| namespace ToSic.Razor.Internals | ||
| { | ||
| public static class ReplaceExtension | ||
| { | ||
| /// <summary> | ||
| /// Returns a new string in which all occurrences of a specified string in the current instance are replaced with another specified string. | ||
| /// This is to be used in .NET Framework or .netstandard 2.0 because .NET 5+ already has this string.Replace() method | ||
| /// based on https://stackoverflow.com/a/36317315 | ||
| /// </summary> | ||
| /// <param name="str">The string performing the replace method.</param> | ||
| /// <param name="find">The string find.</param> | ||
| /// <param name="oldValue">The string to be replaced.</param> | ||
| /// <param name="newValue">The string replace all occurrences of oldValue.</param> | ||
| /// <param name="comparisonType">Type of the comparison.</param> | ||
| /// <returns></returns> | ||
| public static string Replace(this string str, string find, string oldValue, string newValue, StringComparison comparisonType) | ||
| { | ||
| newValue = newValue ?? string.Empty; | ||
| if (string.IsNullOrEmpty(str) || string.IsNullOrEmpty(find) || string.IsNullOrEmpty(oldValue) || oldValue.Equals(newValue, comparisonType)) | ||
| return str; | ||
| var findOffset = find.IndexOf(oldValue, 0, comparisonType); | ||
| if (findOffset < 0) | ||
| return str; | ||
| int foundAt; | ||
| while ((foundAt = str.IndexOf(find, 0, comparisonType)) != -1) | ||
| { | ||
| str = str.Remove(foundAt + findOffset, oldValue.Length).Insert(foundAt + findOffset, newValue); | ||
| } | ||
| return str; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| using System; | ||
| using ToSic.Razor.Internals; | ||
|
|
||
| namespace ToSic.Razor.Wip | ||
| { | ||
| /// <summary> | ||
| /// TODO: WIP | ||
| /// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html | ||
| /// https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#a7-cross-site-scripting-xss | ||
| /// </summary> | ||
| public class XssPrevention | ||
| { | ||
| /// <summary> | ||
| /// Output Encoding for "JSON-LD Contexts" | ||
| /// https://w3c.github.io/json-ld-syntax/#restrictions-for-contents-of-json-ld-script-elements | ||
| /// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts | ||
| /// Authors should avoid using character sequences in scripts embedded in HTML which may be confused with a | ||
| /// comment-open, script-open, comment-close, or script-close. | ||
| /// Partial encode < and > characters with the \uXXXX unicode encoding format (X = Integer). | ||
| /// </summary> | ||
| /// <param name="unsafeJsonLd"></param> | ||
| /// <returns></returns> | ||
| public static string JsonLdScriptEncoding(string unsafeJsonLd) => unsafeJsonLd | ||
| .Replace("<!--", "<", @"\u003C", StringComparison.OrdinalIgnoreCase) | ||
| .Replace("<script", "<", @"\u003C", StringComparison.OrdinalIgnoreCase) | ||
| .Replace("-->", ">", @"\u003E", StringComparison.OrdinalIgnoreCase) | ||
| .Replace("</script", "<", @"\u003C", StringComparison.OrdinalIgnoreCase); | ||
|
|
||
| ///// <summary> | ||
| ///// Output Encoding for "HTML Contexts" | ||
| ///// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-html-contexts | ||
| ///// Convert & to & | ||
| ///// Convert < to < | ||
| ///// Convert > to > | ||
| ///// Convert " to " | ||
| ///// Convert ' to ' | ||
| ///// Convert / to / | ||
| ///// </summary> | ||
| ///// <param name="unsafeHtml"></param> | ||
| ///// <returns></returns> | ||
| //internal static string HtmlEntityEncoding(string unsafeHtml) => unsafeHtml | ||
| // .Replace("&", "&") // TODO: encode & only in case that unsafeHtml is not already entity encoded | ||
| // .Replace("<", "<") | ||
| // .Replace(">", ">") | ||
| // .Replace("\"", """) | ||
| // .Replace("'", "'"); | ||
|
|
||
| ///// <summary> | ||
| ///// TODO: Output Encoding for "HTML Attribute Contexts" | ||
| ///// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-html-attribute-contexts | ||
| ///// Except for alphanumeric characters, encode all characters with the | ||
| ///// HTML Entity &#xHH; format, including spaces. (HH = Hex Value) | ||
| ///// </summary> | ||
| ///// <param name="unsafeAttributeValue"></param> | ||
| ///// <returns></returns> | ||
| //internal static string HtmlAttributeEncoding(string unsafeAttributeValue) => unsafeAttributeValue; | ||
|
|
||
| ///// <summary> | ||
| ///// TODO: Output Encoding for "URL Contexts" | ||
| ///// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-url-contexts | ||
| ///// Standard percent encoding. URL encoding should only be used to encode parameter values, | ||
| ///// not the entire URL or path fragments of a URL. | ||
| ///// </summary> | ||
| ///// <param name="unsafeParameterValue"></param> | ||
| ///// <returns></returns> | ||
| //internal static string UrlParameterEncoding(string unsafeParameterValue) => unsafeParameterValue; | ||
|
|
||
| ///// <summary> | ||
| ///// TODO: Output Encoding for "JavaScript Contexts" | ||
| ///// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts | ||
| ///// Except for alphanumeric characters, encode all characters with the | ||
| ///// \uXXXX unicode encoding format (X = Integer). | ||
| ///// </summary> | ||
| ///// <param name="unsafeJavaScript"></param> | ||
| ///// <returns></returns> | ||
| //internal static string JavaScriptEncoding(string unsafeJavaScript) => unsafeJavaScript; | ||
|
|
||
| ///// <summary> | ||
| ///// TODO: Output Encoding for "CSS Contexts" | ||
| ///// https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-css-contexts | ||
| ///// CSS encoding supports \XX and \XXXXXX. Using a two character encode can cause problems if | ||
| ///// the next character continues the encode sequence. There are two solutions: | ||
| ///// (a) Add a space after the CSS encode (will be ignored by the CSS parser) | ||
| ///// (b) use the full amount of CSS encoding possible by zero padding the value. | ||
| ///// </summary> | ||
| ///// <param name="unsafeCss"></param> | ||
| ///// <returns></returns> | ||
| //internal static string CssHexEncoding(string unsafeCss) => unsafeCss; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| using Microsoft.VisualStudio.TestTools.UnitTesting; | ||
| using ToSic.Razor.Wip; | ||
|
|
||
| namespace ToSic.RazorBladeTests.WIP | ||
| { | ||
| [TestClass] | ||
| public class XssPreventionTests | ||
| { | ||
| [TestMethod] | ||
| [DataRow("<script>alert('xss')</script><!-- html comment -->", @"\u003Cscript>alert('xss')\u003C/script>\u003C!-- html comment --\u003E")] | ||
| [DataRow(null, null)] | ||
| [DataRow("", "")] | ||
| [DataRow("nothing to do", "nothing to do")] | ||
| [DataRow("</script", "\\u003C/script")] | ||
| [DataRow("</scriptnewtag", "\\u003C/scriptnewtag")] | ||
| [DataRow("</ScRiPt>", "\\u003C/ScRiPt>")] | ||
| [DataRow("</script >", "\\u003C/script >")] | ||
| [DataRow(" </script", " \\u003C/script")] | ||
| [DataRow("\n</script\n\t>", "\n\\u003C/script\n\t>")] | ||
| [DataRow("<<<</script", "<<<\\u003C/script")] | ||
| [DataRow("<><></script", "<><>\\u003C/script")] | ||
| [DataRow("</ script >", "</ script >")] | ||
| [DataRow("< / script >", "< / script >")] | ||
| [DataRow("-->", "--\\u003E")] | ||
| [DataRow("-->>", "--\\u003E>")] | ||
| [DataRow("<-->>", "<--\\u003E>")] | ||
| [DataRow("-- >", "-- >")] | ||
| [DataRow(" --\t\n>\n ", " --\t\n>\n ")] | ||
| public void JsonLdScriptEncoding(string content, string expected) => Assert.AreEqual(expected, XssPrevention.JsonLdScriptEncoding(content)); | ||
| } | ||
| } |