Asp mvc "potentially dangerous Request.Form ..."

Question

I send a message from html to the controller and get an exception in Chrome:

Failed to load the resource: the server responded with a status of 500 (Internal server error)

.net 4.0, web server - webdev in vs2010 my config:

<system.web> <compilation debug="true" targetFramework="4.0"> <assemblies> <add assembly="System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> <add assembly="System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> <add assembly="System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> <add assembly="System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/></assemblies> </compilation> <httpRuntime requestValidationMode="2.0" /> <pages validateRequest="false"> <namespaces> <add namespace="System.Web.Mvc"/> <add namespace="System.Web.Mvc.Ajax"/> <add namespace="System.Web.Mvc.Html"/> <add namespace="System.Web.Routing"/> </namespaces> </pages> 

...

What am I missing?

Answer 1

You need to set [ValidateInput(false)] to the action of the controller for which you want to allow HTML. (Or on the entire controller, but this is bad practice.

Another important thing you have already received is <httpRuntime requestValidationMode="2.0" /> in web.config.

Setting RequestValidate in .aspx or web.config files does not work in MVC, as it is a controller, not a view that asks for confirmation.

Edit:. Meanwhile, MVC 3 was released. This allows you to decorate the individual properties of your model with [AllowHtml] to make them safe without completely disabling query validation.

Answer 2

If you use MVC 3 RC, you can use the new attribute for your property as [AllowHtml]

instead of setting [ValidateInput (false)] in Action Controller.- this will not help you prevent XSS attacks

ASP.NET MVC includes built-in support for protecting against HTML and cross-site Script Injection attacks, and by default if someone tries to publish HTML content as input. Developers must explicitly state that this is allowed (and that they hope their application will support it reliably) in order to enable it. With ASP.NET MVC 3, we are also now supporting a new attribute that you can apply to the properties of models / view modes to indicate that HTML Input is enabled, which allows a much more granular, dry protection path. In recent months, the RC attribute has been named [SkipRequestValidation]. With RC2, we renamed it to [AllowHtml] to make it more intuitive: setting the [AllowHtml] model / viewmodel attribute will call ASP.NET MVC 3 to disable HTML protection insertion when binding only this property.