What do you do when a client requires Rich Text Editing on their website?
- by George Stocker
As we all know by now, XSS attacks are dangerous and really easy to pull off. Various frameworks make it easy to encode HTML, like ASP.NET MVC does:
<%= Html.Encode("string"); %>
But what happens when your client requires that they be able to upload their content directly from a Microsoft Word document?
Here's the scenario: People…