00001: Friend Class CrossSiteScriptingValidation
00002:     Private Shared Function IsAtoZ(ByVal c As Char) As Boolean
00003:         Return (((c >= "a"c) AndAlso (c <= "z"c)) OrElse ((c >= "A"c) AndAlso (c <= "Z"c)))
00004:     End Function
00005: 
00006:     Friend Shared Function IsDangerousString(ByVal s As String, <Out> ByRef matchIndex As Integer) As Boolean
00007:         matchIndex = 0
00008:         Dim startIndex As Integer = 0
00009:         Do While True
00010:             Dim num2 As Integer = s.IndexOfAny(CrossSiteScriptingValidation.startingChars, startIndex)
00011:             If (num2 < 0) Then
00012:                 Return False
00013:             End If
00014:             If (num2 = (s.Length - 1)) Then
00015:                 Return False
00016:             End If
00017:             matchIndex = num2
00018:             Dim ch As Char = s.Chars(num2)
00019:             If (ch <> "&"c) Then
00020:                 If ((ch = "<"c) AndAlso ((CrossSiteScriptingValidation.IsAtoZ(s.Chars((num2 + 1))) OrElse (s.Chars((num2 + 1)) = "!"c)) OrElse (s.Chars((num2 + 1)) = "/"c))) Then
00021:                     Return True
00022:                 End If
00023:             ElseIf (s.Chars((num2 + 1)) = "#"c) Then
00024:                 Return True
00025:             End If
00026:             startIndex = (num2 + 1)
00027:         Loop
00028:     End Function
00029: 
00030:     Friend Shared Function IsDangerousUrl(ByVal s As String) As Boolean
00031:         If String.IsNullOrEmpty(s) Then
00032:             Return False
00033:         End If
00034:         s = s.Trim
00035:         Dim length As Integer = s.Length
00036:         If (((((length > 4) AndAlso ((s.Chars(0) = "h"c) OrElse (s.Chars(0) = "H"c))) AndAlso ((s.Chars(1) = "t"c) OrElse (s.Chars(1) = "T"c))) AndAlso (((s.Chars(2) = "t"c) OrElse (s.Chars(2) = "T"c)) AndAlso ((s.Chars(3) = "p"c) OrElse (s.Chars(3) = "P"c)))) AndAlso ((s.Chars(4) = ":"c) OrElse (((length > 5) AndAlso ((s.Chars(4) = "s"c) OrElse (s.Chars(4) = "S"c))) AndAlso (s.Chars(5) = ":"c)))) Then
00037:             Return False
00038:         End If
00039:         If (s.IndexOf(":"c) = -1) Then
00040:             Return False
00041:         End If
00042:         Return True
00043:     End Function
00044: 
00045:     Friend Shared Function IsValidJavascriptId(ByVal id As String) As Boolean
00046:         If Not String.IsNullOrEmpty(id) Then
00047:             Return CodeGenerator.IsValidLanguageIndependentIdentifier(id)
00048:         End If
00049:         Return True
00050:     End Function
00051: 
00052:     Private Shared startingChars As Char() = New Char() { "<"c, "&"c }
00053: End Class

Comments ( )