New Build of CAT.NET (Version – 1.1.1.9) – Please Upgrade


Syed Aslam Basha here…..I am a tester on the Information Security Tools team.

There is a new build of CAT.NET Version 1.1.1.9 now available for download on MSDN (32 bit here and 64 bit here). We recommend *ALL* users upgrade to this latest release, a bug fix and minor improvements build. As well as some functional bugs we have updated the Encodings.xml file so that AntiXSS, Httputility, Httpserverutility and IOsec methods (now superseded but still in use) libraries will no longer produce false positives.

In Summary

Library

Method

Is it part of encodings.xml?

Anti-XSS

GetNormalizedHtml

Yes

Anti-XSS

GetSafeHtml

Yes

Anti-XSS

GetSafeHtmlFragment

Yes

Anti-XSS

HtmlAttributeEncode

Yes

Anti-XSS

HtmlEncode

Yes

Anti-XSS

JavaScriptEncode

No

Anti-XSS

UrlEncode

Yes

Anti-XSS

VisualBasicScriptEncode

No

Anti-XSS

XmlAttributeEncode

NO

Anti-XSS

XmlEncode

NO

IOSec

AsNumeric

No

IOSec

AsUrl

Yes

IOSec

EncodeHtml

Yes

IOSec

EncodeHtmlAttribute

NO

IOSec

EncodeXml

Yes

IOSec

EncodeXmlAttribute

Yes

IOSec

EncodeJs

No

IOSec

EncodeVbs

No

HttpUtility

HtmlAttributeEncode

Yes

HttpUtility

HtmlDecode

Yes

HttpUtility

HtmlEncode

Yes

HttpUtility

UrlDecode

Yes

HttpUtility

UrlDecodeToBytes

No

HttpUtility

UrlEncode

Yes

HttpUtility

UrlEncodeToBytes

No

HttpUtility

UrlEncodeUnicode

No

HttpUtility

UrlEncodeUnicodeToBytes

No

HttpUtility

UrlPathEncode

Yes

HttpServerUtility

HtmlDecode

Yes

HttpServerUtility

HtmlEncode

Yes

HttpServerUtility

UrlDecode

Yes

HttpServerUtility

UrlEncode

Yes

HttpServerUtility

UrlPathEncode

Yes

HttpServerUtility

UrlTokenDecode

No

HttpServerUtility

UrlTokenEncode

No

A full list of changes can be found in the changelog in the new build.

– Syed

Comments (3)

  1. will.net says:

    What’s the Anti-XSS version it use?  I couldn’t found the "GetNormalizedHtml" method in the Anti-XSS 3.0Beta.

  2. clively says:

    Have you guys fixed the memory consumption issues yet?  We had to abandon usage of this simply because it consistently ran out of memory on our 4GB build server for anything other than a simple project.

  3. cisg says:

    Clively, that will come with CAT.NET 2.0 (ETA 6 months to complete but 3 – 4 for betas). Complete new engine / algorithm design so we address that and make it totally scaleable.

    Andreas made a recent post about some of the ideas being considered.