title: how to sanitize input data in web api using anti xss attack
body: <p>Below is the snippet of my code</p>
  
  <p>Model class</p>
  
  <p>// Customer.cs</p>
  
  <pre><code>using CommonLayer;
  
  namespace Models
  {
      public class Customer
      {
          public int Id { get; set; }
  
          [MyAntiXss]
          public string Name { get; set; }
      }
  }
  </code></pre>
  
  <p>I want to sanitize the value in the 'Name' field of the Model class as below</p>
  
  <p>// CutstomModelBinder.cs</p>
  
  <pre><code> using Microsoft.Security.Application;
      using System.ComponentModel;
      using System.Linq;
      using System.Web.Mvc;
  
      namespace CommonLayer
      {
          public class CutstomModelBinder : DefaultModelBinder
          {
              protected override void BindProperty(ControllerContext controllerContext, ModelBindingContext bindingContext, PropertyDescriptor propertyDescriptor)
              {
                  if (propertyDescriptor.Attributes.OfType&lt;MyAntiXssAttribute&gt;().Any())
                  {
                      ValueProviderResult valueResult = bindingContext.ValueProvider.GetValue(propertyDescriptor.Name);
                      string filteredValue = Encoder.HtmlEncode(valueResult.AttemptedValue);
                      propertyDescriptor.SetValue(bindingContext.Model, filteredValue);
                  }
                  else
                      base.BindProperty(controllerContext, bindingContext, propertyDescriptor);
              }
          }
      }
  </code></pre>
  
  <p>I changed the 'DefaultBinder' to my 'CutstomModelBinder' as below</p>
  
  <p>// Global.asax.cs</p>
  
  <pre><code>using CommonLayer;
  using System.Web.Http;
  using System.Web;
  using System.Web.Mvc;
  
  namespace WebAPI
  {
      public class WebApiApplication : HttpApplication
      {
          protected void Application_Start()
          {
              GlobalConfiguration.Configure(WebApiConfig.Register);
              ModelBinders.Binders.DefaultBinder = new CutstomModelBinder();
          }
      }
  }
  </code></pre>
  
  <p>I wrote a controller class as below</p>
  
  <p>// CustomerController.cs</p>
  
  <pre><code>using Models;
  using System.Collections.Generic;
  using System.Web.Http;
  
  namespace WebAPI.Controllers
  {
      public class CustomerController : ApiController
      {
          public string Post([FromBody]Customer customer)
          {
              //customer.Name = Encoder.HtmlEncode(customer.Name);
              return string.Format("Id = {0}, Name = '{1}'", customer.Id, customer.Name);
          }
      }
  }
  </code></pre>
  
  <p>When I am calling the above controller's class 'Post' method as below, it is giving call to the 'Post' method of the controller's class as expected. But it is not calling the 'BindProperty' method in my 'CutstomModelBinder' class.</p>
  
  <p>// Program.cs</p>
  
  <pre><code>using Models;
  using System;
  using System.Net.Http;
  using System.Net.Http.Formatting;
  using System.Net.Http.Headers;
  
  namespace Client
  {
      public static class Program
      {
          public static void Main(params string[] args)
          {
              bool success = Post();
              Console.WriteLine("success = " + success);
              Console.Read();
          }
  
          private static HttpClient GetHttpClient()
          {
              HttpClient client = new HttpClient { BaseAddress = new Uri("http://localhost:49295/") };
              client.DefaultRequestHeaders.Accept.Clear();
              client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
              return client;
          }
  
          private static bool Post()
          {
              Customer customer = new Customer { Id = 1, Name = "&lt;br&gt;Anivesh&lt;/br&gt;" };
              HttpContent content = new ObjectContent&lt;Customer&gt;(customer, new JsonMediaTypeFormatter());
  
              HttpClient client = GetHttpClient();
              HttpResponseMessage response = client.PostAsync("Customer", content).Result;
              client.Dispose();
  
              if (response.IsSuccessStatusCode)
              {
                  string expected = string.Format("Id = {0}, Name = '{1}'", customer.Id, customer.Name);
                  string result = response.Content.ReadAsAsync&lt;string&gt;().Result;
                  return expected == result;
              }
              else
                  return false;
          }
      }
  }
  </code></pre>
  
  <p>Please let me know the correct way of using the 'DataBinders', so that I could sanitize the input data at a common place, before receiving calls in the controllers.</p>