title: Fixings Cross Site Scripting (Reflected) in ASP.Net MVC
body: <p>I have been using the <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project" rel="nofollow noreferrer">Zed Attack Proxy (ZAP)</a> to test a new application being developed. The App is ASP.NET MVC4 based using the standard HTML helpers where ever possible.</p>
  
  <p>ZAP has identified the following alert:</p>
  
  <p>Cross Site Scripting (Reflected)</p>
  
  <pre><code>GET:  localhost:65227/CashReceipt?SearchText=javascript%3Aalert%281%29%3B
  </code></pre>
  
  <p>On this page we have a list of receipts and a search box whereby a user can search by receipt number.</p>
  
  <p>When this page is called using the link above, the following Razor builds the relevant part of the page:</p>
  
  <pre><code>@using (Html.BeginForm("Index", "CashReceipt", FormMethod.Get, new { @class = "form-inline", @role = "form" }))
  {
  &lt;div class="form-group"&gt;
      &lt;label class="hidden-label" for="SearchText"&gt;Search For&lt;/label&gt;
      @Html.TextBoxFor(m =&gt; m.SearchText, new { @class = "form-control input-lg", @placeholder = "Receipt Number" })
  &lt;/div&gt;
  &lt;input type="submit" value="Search" class="btn btn-primary btn-lg" /&gt;
  }
  </code></pre>
  
  <p>the HTML generated is: </p>
  
  <pre><code>&lt;input class="form-control input-lg" id="SearchText" name="SearchText" placeholder="Receipt Number" type="text" value="javascript:alert(1);" /&gt;
  </code></pre>
  
  <p>The page rendered appears as: </p>
  
  <p><img src="https://i.stack.imgur.com/Y6IEm.png" alt="enter image description here"></p>
  
  <p>This does not result in an actual alert box being displayed within the browser, just the text is reflected back.</p>
  
  <p>Is this an XSS issue that needs to be resolved? If so, how?</p>