哪些字符或字符组合是无效的,当ValidateRequest设置为true?字符、组合、设置为、ValidateRequest

2023-09-03 00:00:07 作者:我叫叶良辰

我试图寻找在微软的网站,谷歌搜索这一点,但似乎没有人有答案除了在<和>。还有更多的比,虽然。我注意到的与放大器的HTML实体起动;#无效。还有什么事吗?有没有人有一个完整列表?

谢谢!

解决方案

通过名单字符框架版本

  

1.1框架验证:

  *放大器;#
*<α,<!,< /
* 脚本
*像OnMouseEnter在等处理...
* EX pression(
*寻找这些起始字符('<','和;','O','O','S',
 

     

'S','E','E')

     

这显然是一个pretty的严格列表   项目将触发   验证错误。在2.0   框架,微软决定放松   这个限制相当多。   下面是验证检查清单   在2.0框架。

     

2.0框架验证:

  *放大器;#
*<α,<!,< /,&LT ;?
*寻找这些起始字符('<','和;')
 
Web安全测试之XSS实例讲解

I've tried looking at the Microsoft site and Googling this but nobody seems to have an answer aside from the < and the >. There's more to it than that though. I've noticed that the HTML entity starter of &# is invalid. Is there anything else? Does anyone have a complete list?

Thanks!

解决方案

List of characters by framework version

1.1 Framework Validation:

* &#
* <alpha, <!, </
* script
* On handlers like onmouseenter, etc…
* expression(
* Looks for these starting characters (‘<’, ‘&’, ‘o’, ‘O’, ‘s’,

‘S’, ‘e’, ‘E’)

This is obviously a pretty strict list of items that would trigger a validation error. In the 2.0 Framework, Microsoft decided to loosen the restrictions on this quite a bit. Below is the list of validation checks in the 2.0 Framework.

2.0 Framework Validation:

* &#
* <alpha, <!, </, <?
* Looks for these starting characters (‘<’, ‘&’)