[SOLVED] Service Stack - Security XSS Query following pentest

Service Stack - Security XSS Query following pentest

We recently had a penetration test done, and one of the "high" items was the fact that our servicestack API will reflect back user input unmodified to the caller. E.g. I can send some script tags in to a GET request, and will get an error on back from the API with the script tags in it:

Has anyone else experienced this, or is there anything built in to servicestack to prevent it?

Thanks!

Solution

You can modify the Exception Message by overriding OnExceptionTypeFilter in your AppHost, e.g:

public class AppHost() : AppHostBase("My App"), IHostingStartup
{
    public override void OnExceptionTypeFilter(
        Exception ex, ResponseStatus responseStatus)
    {
        base.OnExceptionTypeFilter(ex, responseStatus);
        responseStatus.Message = Sanitize(responseStatus.Message);
    }
    //...
}