Description

Detects when user-controlled input is directly passed into ASP.NET Core's Content() method with HTML content type without proper encoding. This creates a Cross-Site Scripting (XSS) vulnerability by allowing attackers to inject malicious scripts that execute in users' browsers.

Detection Strategy

• Check if Microsoft.AspNetCore.Mvc library is imported in the codebase

• Look for calls to Content() method in controller actions

• Verify the content type parameter indicates HTML content (e.g. 'text/html')

• Confirm the content parameter contains user-controllable data (e.g. from request parameters, form data, query strings)

• Flag as vulnerable if unencoded user input is passed directly to HTML content response

Vulnerable code example

using Microsoft.AspNetCore.Mvc;

public class SearchController : Controller
{
    public IActionResult Search(HttpRequest request)
    {
        // Vulnerable: Directly renders user input as HTML without sanitization
        return Content(request.Params["query"], "text/html");...

✅ Secure code example

using Microsoft.AspNetCore.Mvc;
using System.Text.Encodings.Web;

public class SearchController : Controller
{
    public IActionResult Search(HttpRequest request)
    {
        // Secure: Encode user input to prevent XSS attacks...