and

2019-06-14 11:56发布

I've inherited an MVC asp.net app using framework 4.0.

I'm getting the dreaded "A potentially dangerous Request.Form value was detected from the client" error and all my research leads me to believe that this should fix it:

<system.web>
    <httpRuntime requestValidationMode="2.0" />
    <pages validateRequest="false" />
</system.web>

However, I've added that to my web.config and still get the error. I'm at the end of my rope here, what am I missing?

3条回答
爱情/是我丢掉的垃圾
2楼-- · 2019-06-14 12:10

The simplest way is to remove the characters you want from the validation system.

Here is the requestPathInvalidCharacters attribute from the httpRuntime element with its default value.

<httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,:,\" />
<!-- the unescaped characters are: < > * % & : \  -->

Remove the characters you want to authorize and the request will work.

查看更多
Evening l夕情丶
3楼-- · 2019-06-14 12:12

Take another approach. In the httpRuntime, point to your custom validation class. This way have the complete control over incoming requests as the validator is fired upon each single request, at the beginning of the processing pipeline.

In particular, if you implement your validator to return true, you will unconditionally accept all incoming requests.

http://msdn.microsoft.com/en-us/library/system.web.util.requestvalidator.aspx

查看更多
戒情不戒烟
4楼-- · 2019-06-14 12:31

In addition to what you did you also have to decorate your methods with the ValidateInput attribute.

[ValidateInput(false)]
public ActionResult MyActionMethod(string myParameter)
{
    // Method implementation goes here... 
}

There is an alternative though, you can implement your own request validator and bind that in your web.config if you want to handle validation for your entire site. Take a look at this blog post on how to fully implement it.

Basically, create a class that inherits from RequestValidator and then hook it up on the web.config.

<httpRuntime requestValidationType=”Globals.CustomRequestValidation”/>

Hopefully this helps!

查看更多
登录 后发表回答