Context Aware Model Encoding

[SerratedSharp]

I recently read the OWASP XSS Prevention Cheat Sheet, and noticed that what encoding is performed is conditional on the context. Sanitizing user content for a DOM element requires different encoding than if it were inserted into an attribute. Sometimes you must javascript escape then HTML escape user content (which are different types of sanitization) for certain contexts to properly sanitize it: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html

This isn't too surprising but I didn't consider it before.

Since CSHTML has knowledge of the HTML structure, and it is automatically encoding Model references, is it doing context aware encoding? I.e. does it recognize when you have a Model. reference inside a DOM attribute and does the additional encoding?

[SerratedSharp]

I'm still curious about this. I saw a code example where someone was doing this:

<input name="fieldname" value="@Html.Raw(Html.AttributeEncode(Model.Username))">

Is this necessary? Or does razor parser have some knowledge of context and do the correct encoding for attributes?