An Improvement on Output Encoding in .Net

Most people I talk within the application security community usually hear me say that the frameworks are not great in preventing common vulnerabilities like XSS. Well as I am changing jobs and I want to brush up on some C# concepts I decided to put my coding skills where my big fat mouth is. I sat down for 30 minutes and wrote a prototype and I will continue working on this throughout the week to get more familiar with the framework.

Just to prove that I am not just talking up a storm here is the initial code.

public static class SaferEncoding
{
   public static void SaferText(this System.Web.UI.WebControls.Label lbl, System.String s)
   {
       lbl.Text = AntiXss.HtmlEncode(s);
   }
}

Some might notice that I am using AntiXss for the encoding. The reason? Because I know encoding has many nuances so why not have someone else use it. Also, why didn't I override the Text property for the label? Well, there are two reasons:

1. I wanted it easy for people to find out where they were not properly encoding. For example a security auditor could come in and do a search on ".Text" and if any appeared they would need to have a good reason to use that property.
2. Sometimes an un-encoded value needs to be used and I understand this.

I will post the updates as they come along, along with the code and binaries. Maybe someone will find this useful.

Funny Amazon Recommendation

I was sent this today by Heather Burgess (who would I link to if she got her blog up and running :P). I thought it was a great example of when software goes bad, very very bad/naughty.

Well if that doesn't make you smirk at least, you might want to check your pulse.

P.S. Dang two posts in a day a new PR

Tact filter geeks/nerds vs. "normal" people

I saw this today.  I think it is true (obviously there are exceptions) but it makes sense to me. Well read on maybe it will help others when dealing with the other group (e.g. geeks talking to non-geeks and vice versa).

A friendly reminder....

You are always only limited by your time.  Everything else stems from that.  Remember this next time you decide to watch TV and then complain about something in your life.