Microsoft Anti-Cross Site Scripting Library V1.5 is Released!



I wanted to announce that today the ACE and the ASP.NET team released V1.5 of the Anti-Cross Site Scripting Library at This library is essentially the same library that we used to call IOSec (whose name is retiring so we can converge on a single name) and we’re excited about finally being able to provide you with tools like these to develop more secure applications!


Top 5 Reasons Why You Should Upgrade

Migrating to V1.5 will require a few steps on your part, but here are the top reasons why you should upgrade to this version:

  • Reason #1 - More Encoding Methods: Encoding methods for JavaScript, Visual Basic Script, XML and more will be included to provide even more protection against XSS attacks.

Encoding Method

Version 1.0

Version 1.5






















  • Reason #2 - Allow Partially Trusted Caller Attribute (APTCA) Support: The new library can be deployed in least privileged scenarios (that's a good thing!).  There are certainly ways APTCA can be abused when not implemented properly so we’ve taken steps to limit that possibility such as using things like the SecurityTransparent (2.0 only), RequestMinimum and RequestOptional attributes.

  • Reason #3 - Improved Documentation, Sample Applications and Tutorials: Version 1.0 contained some examples of implementations of the library; however what was missing was pragmatic tutorials on how to implement the library properly.  Along side this release you’ll find a tutorial on how to implement the library, along with a simple technique for determining if data requires encoding or not at (we already know about the image rendering issue and it's getting fixed =P).  Finally you’ll notice that the documentation for V1.5 has also been significantly improved.

  • Reason #4 - A Much Clearer and Flexible End User License Agreement (EULA): The EULA included with V1.0 was confusing and did not allow the library to be deployed in production environments.  V1.5’s EULA is much clearer and provides the ability to deploy into production environments.

  • Reason #5 – Easy Upgrade Path for V1.0 Users:  Users developing on top of the V1.0 release can easily migrate to V1.5. The old namespace used in V1.0 is supported in V1.5 and so V1.0 users should find migration relatively transparent.


What’s Next?

Already people are asking this!  In later versions we’ll look towards providing you with automatically encoding Web controls, intelligent filtering capabilities and much more.  And of course, the ACE team will continue releasing other security tools (new versions of TAM, and others …) so keep visiting this blog for updates!


Thanks and enjoy this release!


Kevin Lam, CISSP | Senior Security Technologist | ACE Security Services Team 
Assessing Network Security Book -
Kevin Lam's Blog -


Comments (7)
  1. Microsoft hat die Anti-Cross Site Scripting Library [1] nun in der Version 1.5 [2] veröffentlicht. Damit können Webanwendungen gegen Cross Site Scripting (XSS) abegehärtet werden. Mit der aktuellen Version sind auch Methoden für das absichern vo

  2. 微软的Anti-Cross Site Scripting Library旨在方便开发人员对HTML输出进行编码(encode)以避免跨站脚本攻击(XSS)。与其他的编码库不同,这个脚本库采用的是“Principle…

  3. says:

    La fameuse librairie anti XSS est disponible depuis lundi sur le site de Microsoft. Il faut dire que cette nouvelle tombe

  4. Most folks know that cross-site scripting (XSS) bugs can be used to steal logon cookies, as this scenario

  5. Lynn’s slides – Jan 2008 Allup » SlideShare Original slides and session recordings –

  6. Lynn's slides – Jan 2008 Allup » SlideShare Original slides and session recordings – http://www.msdnevents

Comments are closed.

Skip to main content