Syed Aslam Basha here…..I am a tester on the Information Security Tools team.
There is a new build of CAT.NET Version 1.1.1.9 now available for download on MSDN (32 bit here and 64 bit here). We recommend *ALL* users upgrade to this latest release, a bug fix and minor improvements build. As well as some functional bugs we have updated the Encodings.xml file so that AntiXSS, Httputility, Httpserverutility and IOsec methods (now superseded but still in use) libraries will no longer produce false positives.
In Summary
Library
Method
Is it part of encodings.xml?
Anti-XSS
GetNormalizedHtml
Yes
GetSafeHtml
GetSafeHtmlFragment
HtmlAttributeEncode
HtmlEncode
JavaScriptEncode
No
UrlEncode
VisualBasicScriptEncode
XmlAttributeEncode
NO
XmlEncode
IOSec
AsNumeric
AsUrl
EncodeHtml
EncodeHtmlAttribute
EncodeXml
EncodeXmlAttribute
EncodeJs
EncodeVbs
HttpUtility
HtmlDecode
UrlDecode
UrlDecodeToBytes
UrlEncodeToBytes
UrlEncodeUnicode
UrlEncodeUnicodeToBytes
UrlPathEncode
HttpServerUtility
UrlTokenDecode
UrlTokenEncode
A full list of changes can be found in the changelog in the new build.
- Syed