Instead all HTML tags can be removed except those specifically deemed are safe. This is referred to as a whitelist approach. This can have a more unpredictable effect on user input, but it is generally safer if script injection attacks are a concern.
HTML formatting generated by the application, such as the Report Viewer, is not vulnerable to script injection.
To filter user input by a whitelist:
Note
This article references
<WebApp>
,<Sched>
as a placeholder for the application’s install location and the Scheduler Service’s install location, respectively.
<WebApp>appSettings.config
<Sched>eWebReportsScheduler.exe.config
<appSettings> </appSettings>
tags:
<add key="inputSanitizationMethod" value="Aggressive" />
To view and edit the tag whitelists, edit the appropriate whitelist file in a text editor. The whitelist files contain a JSON-formatted array of strings.To strip all HTML tags from user input, remove all tags from the tagwhitelist.json
files:
Tip
To learn more about JSON, refer to the Using JSON article.
<WebApp>ConfigOthertagwhitelist.json
<Sched>bintagwhitelist.json
Be cautious about adding potentially unsafe tags such as <input>
and <iframe>
to the whitelist. Removing HTML tags from the whitelist may cause existing reports to display incorrectly.