Zennoxa Shield
Rules / C#
SHIELD-CSHARP-018

Reflected XSS via Response.Write or Html.Raw

highC#CWE-79CVSS 7.4

What it detects

Untrusted request input is written to the response without encoding, or rendered with Html.Raw.

How to fix

HTML-encode untrusted output and avoid Html.Raw for user-controlled content.

Vulnerable — Shield flags thisGreetingPage.cs
public partial class GreetingPage : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        // Reflected XSS: query value echoed without encoding
        Response.Write("<h2>Welcome back, " + Request.QueryString["name"] + "</h2>");
    }
}
Fixed — scans cleanGreetingPage.cs
using System.Web;

public partial class GreetingPage : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        var name = Request.QueryString["name"];
        Response.Write("<h2>Welcome back, " + HttpUtility.HtmlEncode(name) + "</h2>");
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-018, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-018: Reflected XSS via Response.Write or Html.Raw — Zennoxa Shield