1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.

Unfortunately, their upgrade timeline is not soon enough.
In the meantime, they're trying to plug some of the larger holes... E.g. very common cross-site scripting flaws. Of course, I recommended using MS' AntiXSS Library for that (especially since many of the flaws would not be plugged with simple HtmlEncode)...

Unfortunately, AntiXSS doesn't work with ASP.NET 1.1 - or, at least as far as I know. The versions I found go back to ASP.NET 2.0 (version 1.5).

So, the question - was there a version for 1.1? If so, where can I find it? If not, do you have anything else to do the job - in ASP.NET 1.1?

AviD
  • 72,138
  • 22
  • 136
  • 218
  • 1
    Can't think of anything except good old Regex and input validation...... – CtrlDot Mar 23 '11 at 00:54
  • There seems to be a .NET version of [AntiSamy](http://code.google.com/p/owaspantisamy/source/browse/#svn/trunk/dotNet/current/source/owaspantisamy) – Mike Samuel May 09 '12 at 06:23

2 Answers2

1

There was not a version for ASP.NET 1.1. The AntiXss library is open source though, so you might be able to find the earliest version and try to convert to 1.1.

Steve
  • 15,155
  • 3
  • 37
  • 66
  • That's what I was afraid of... Still hoping someone has/had an alternative that they can just use... – AviD Mar 22 '11 at 23:36
0

You can use the version 1.0 of the Microsoft Anti-Cross Site Scripting Library

As said in that page:

Important Update: A V1.5 of this library that provides more functionality on top of the original feature set has been released and can be downloaded at this location. .NET 1.0 users can continue using this version, otherwise all other users should migrate towards V1.5 or above.

So don't expect too much of this version, I has only 2 methods you can use:

  • AntiXSSLibrary.HtmlEncode()
  • AntiXSSLibrary.UrlEncode()
Mariano Desanze
  • 101
  • 2