Anti-XSS Library v3.1: Find, Fix, and Verify Errors (Channel 9)

Anil Revuru (RV) from Microsoft Information Security, gives a demonstration of the new features on the Anti-XSS Library v3.1 including HTML Sanitization which provides new methods to the Anti-XSS class to strip malicious characters or scripts off of HTML and returns safe HTML.

He talks about:

What is Cross-Site Scripting Attack (XSS)
How to detect Cross Site Scripting Vulnerabilities
Introduction of Anti-XSS Library
What’s new in Anti-XSS Library 3.1
Anti-XSS 3.1 demo
Security Runtime Engine (SRE)
SRE Demo

To learn more about this application and stay up to date on the latest news, read the following blogs from Information Security and previous posts from the Security Tools Team blog.

Overview of the Anti-XSS Library
Download: Microsoft Anti-Cross Site Scripting Library v3.1

Follow the Discussion

Follow
Oops, something didn't work.

Try again?

Sign In to begin to follow these comments

What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.

Getting "follow" information

Stop following these comments

Start following these comments

What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.

Removing your "follow"

Setting up your "follow"

Did you know you can
sign up for email notifications?
- Subscribe to these comments

Tavis

Nov 10, 2009 at 6:32 AM

I get an error message when I tried to play the video:

Media Failure. Try reloading the page or visiting the main site for assistance.

I tried reloading the page without success.
Jossie

Nov 11, 2009 at 9:53 AM

Hi Tavis, try playing the video now. Usually it is not the video but the site. When you see that message come back to the video later and it tends to be fixed. It worked for me now. Let me know!
SrinivasG

Nov 12, 2009 at 4:01 AM

Thanks for the demo.. This is really very informative..
ramaraju.r

Nov 15, 2009 at 7:57 PM

Thanks a lot! Very informative.
Elroy Flynn

Nov 24, 2009 at 8:29 PM

It sure would be nice to have the usual controls for this presentation (stop/start/rewind)
Rasha

Dec 27, 2009 at 7:35 PM

Informative, as everyone said...but got no sound!! Can any one help me out? Sometimes media player is opened, after the completion of down load, i am asked to download some codec to run!!..
f.hausman

Jan 24, 2010 at 6:38 AM

Thanks for posting this presentation.

Bad news: Sound for this slideshow won't play in Silverlight 3.0.50106.0 (from silverlight.net) in IE 8.0.6001.1870 and FF 3.6, Win XP SP3 + all updates, AMD Sempron 1.8GHz. I don't think it's a CPU issue, because other videos do play with sound, such as this one uploaded by Jossie on the same day (Sept. 23, 2009): http://channel9.msdn.com/posts/Jossie/Connected-Information-Security-Framework-Core-Components/ and http://channel9.msdn.com/posts/Jossie/Technical-Preview-for-CATNET-20/

Good news, workaround: copying the URL from the embed HTML ( < /> icon) and pasting it into Windows Media Player 11 "Open URL", the video+audio streams perfectly:

http://ecn.channel9.msdn.com/o9/ch9/6/9/6/3/9/4/antiXSS31_ch9.wmv

The trouble?: WMP11 says the audio codec is: "Windows Media Audio 10 Professional, 128 kbps, 44 kHz, 2 channel 24 bit 2-pass VBR". 24 bits seems like overkill for a voiceover, and Silverlight 3.0 won't play it. (Or is it a container problem?)

Suggestion: In future, encode audio for WMA 9 and/or 16 bit for maximum backward compatibility.
kumaratwin

Jun 01, 2010 at 6:37 AM

Can I use this on classic ASP applications? Please point me to a right article or video if we can?

Thanks,

Kumar Pindiprolu.
anilkr

Aug 23, 2010 at 9:39 AM

Unfortunately both Anti-XSS library and CAT.NET work on mangaed code. It can't be used with classic ASP applications.