In ASP.NET 4.5, how should I encode a string to be used as a JavaScript variable, to prevent XSS attacks -

i know of several ways this, have downside. there "accepted" way of doing it, considered best?

i used use microsoft.security.application.antixss.javascriptencode() great, antixss has been end-of-lifed because encoder included in .net of 4.5.

however, reason, system.web.security.antixss.antixssencoder doesn't include javascriptencode method.

there's system.web.httputility.javascriptstringencode(), uses blacklist method encoding, it's unlikely whitelist encoder.

and i've seen recommendations use system.web.script.serialization.javascriptserializer.serialize(), calls httputility.javascriptstringencode().

so what's best accepted, whitelist method encoding values written out js variables?

if wish include javascript code within <script> block this:

<script> var myvariable = '<%=thisiswrong %>'; </script> 

then in context httputility.javascriptstringencode should used. function correctly encodes special characters, if </script> rendered in script tag in attempt close html script tag ready xss attack, rendered as:

\u003c/script\u003e 

which correct encoding javascript understand </script>, without browser interpreting literal closing script tag. naively written javascript encoding routines not convert because sequence not contain \, " or ' characters.

if don't make sure closing script tags not rendered, attack possible. imagine input application:

</script><script>alert(1)</script> 

which renders in browser as

<script type="text/javascript">  alert('</script><script>alert(1)</script>');  </script> 

and browser interpret script tag ending @ alert('</script> , execute in new script tag.

with javascriptstringencode function safe rendered as:

<script type="text/javascript">  alert('\u003c/script\u003e\u003cscript\u003ealert(1)\u003c/script\u003e');  </script> 

which not contain </script> browser interpret.

there's system.web.httputility.javascriptstringencode(), uses blacklist method encoding, it's unlikely whitelist encoder.

some of other encoding functions in .net use blacklist methods, in own testing javascriptstringencode seems ample.

the owasp recommendation javascript is

except alphanumeric characters, escape characters less 256 \xhh format prevent switching out of data value script context or attribute.

so write own comply this.

note if want include code in attribute tags:

<a href="http://example.com" onclick="alert('<%=wrong>')">click</a> 

then owasp method means don't have take care of html encoding (because no html characters special meaning output). without (e.g. javascriptscriptencode) need html encode too.

having said this, safer way approach answer question secure way of inserting dynamic values in external javascript files. use data- attributes place dynamic values in dom (in html) , use javascript extract these values. prevent javascript encoding headaches.