asp.net MVC page using Rich text controls for XSS vulnerabilities __.net

There are XSS security vulnerabilities in the project being done.

The reason is that some pages use a rich text edit box, so that its content can be submitted, set the [ValidateInput (false)] attribute for the related action:

        [HttpPost]
        [ValidateInput (false)]
        Public ActionResult Mailpreview (formcollection collection)
        {return
            View ();
        }

But the problem is, the same page has other field content, now HTML, JS script can be submitted, no longer limited, or the time to submit all check, otherwise there are XSS vulnerabilities. I entered a text box <script>alert (0), </script>, after the successful submission, the page shows the content of the submission, actually executed.

So be careful not to turn on this [ValidateInput (false)] feature easily. I don't think it should be open at all. Can purple:

    public class MAILVM
    {public
        string Title {get; set;}
        public string Time {get; set;}
        [Allowhtml]
        public string Mess {get; set;}
    }

Set [allowhtml] for a single field of this entity class, and the system will leave that field alone when submitting it.

The problem is that the action cannot use FormCollection to receive submission data, but it should use entity classes. Otherwise the [allowhtml] attribute does not work. The principle of this check should be the system filter in the interception, you a formcollection, how the filter effort. Therefore, the above code should read:

        [HttpPost]
        Public ActionResult Mailpreview (MAILVM model)
        {return
            View ();
        }

The entity classes are certainly not formcollection flexible, but they are necessary for this particular occasion. In particular, entity classes can be used only when submitting, page output does not require binding entity classes, page text boxes and other controls, also do not necessarily write @Html. textboxfor this form. Just need

        [HttpPost]
        Public ActionResult Mailpreview (MAILVM model)
        {
            ...
        }

The system automatically assembles the submission data according to model.