SharePoint Code Analysis Framework (SPCAF)

SPC020201: Do not update list of blocked extensions

SPC020202: Avoid setting 'AllowUnsafeUpdates' on SPWeb

SPC020203: Avoid setting 'AllowUnsafeUpdates' on SPSite

SPC020204: Do not call 'WindowsIdentity.Impersonate'

SPC020205: Do not set 'AllowEveryoneViewItems' for SPList to TRUE

SPC020206: Avoid usage of 'RunWithElevatedPrivileges'

SPC020210: Do not add PageParserPaths to web.config

SPC020220: Do not call 'HttpUtility.HtmlEncode'.

SPC020221: Do not nest calls to RunWithElevatedPrivileges

SPC020602: CAS Policy 'Maschine' with access='Administer' is not allowed

SPC020603: Policy Permission Impersonate not allowed

SPC020611: Do not define 'FileIOPermission' with 'Unrestricted=true'

SPC020612: Do not define 'RegistryPermission' with 'Unrestricted=true'

SPC020613: Do not define 'SecurityPermission' with 'Unrestricted=true'

SPC020614: Do not define 'EnvironmentPermission' with 'Unrestricted=true'

SPC020615: Do not define 'SmtpPermission' with 'Unrestricted=true'

SPC025501: Do not set 'AllowEveryoneViewItems' to TRUE in ListDefinition

SPC026901: Do not use inline code in ASPX pages

SPC026902: Add 'SharePoint:FormDigest' to ASPX page

SPC020220: Do not call 'HttpUtility.HtmlEncode'.

The assembly should not call HttpUtility.HtmlEncode(string) to encode strings. Use 'SPHttpUtility.HtmlEncode' instead.

TypeName:	DoNotCallHttpUtilityHtmlEncode
CheckId:	SPC020220
Severity:	CriticalWarning
Type:	AssemblyFileReference

Resolution

Remove calls to 'HttpUtility.HtmlEncode'. The .NET Framework HttpUtility encoding library does not encode all characters sufficiently. For example, SPHttpUtility in SharePoint encodes a single quotation mark as ' but .NET Framework HttpUtility does not encode the single quotation mark.

Links

Security Best Practices for Developers in SharePoint 2010

comments powered by Disqus

Copyright © 2013 RENCORE AB. All Rights Reserved

Disclaimer: The views and opinions expressed in this documentation and in SPCAF are those of the creators and do not necessarily reflect the opinions and recommendations of Microsoft or any member of Microsoft. All trademarks, service marks, collective marks, copyrights, registered names, and marks used or cited by this documentation are the property of their respective owners.

SharePoint Code Analysis Framework, Version 4.5.2.7855, see www.spcaf.com for more information