Error Strate ValidateInputIfRequiredByConfig

Question

I get a random exception thrown by ValidateInputIfRequiredByConfig ().

I do not have an exact message, since our server is pt-BR, so the error message is translated.

I know that this error can be caused if the user enters malicious code into the input, i.e. example. But this is not the case here.

I get this by requesting some images. Below is some information from elmah.

HTTP_USER_AGENT: GbPlugin PATH_INFO: /Content/images/BannerWelcome.jpg?1110311762734 PATH_TRANSLATED: C:\inetpub\wwwroot\Content\images\BannerWelcome.jpg?1110311762734 REQUEST_METHOD: GET SCRIPT_NAME: /Content/images/BannerWelcome.jpg?1110311762734 

ASP.NET MVC 3 Application Running on Windows 2008, IIS 7.5

EDIT:

Exception message in pt-BR:

 System.Web.HttpException Um valor possivelmente perigoso Request.Path foi detectado no cliente (?). System.Web.HttpException (0x80004005): Um valor possivelmente perigoso Request.Path foi detectado no cliente (?). em System.Web.HttpRequest.ValidateInputIfRequiredByConfig() em System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context) 

EDIT:

English exception message: "A potentially dangerous value was found at the Request.Path client"

EDIT 2:

I can not reproduce this error. As I know, this is just a request for this image.

Answer 1

 <pages validateRequest="false" /> 

not working in MVC3.

1) You must explicitly put [ValidateRequest (false)] on each controller or action

2) If you use .NET4, this is not enough, since in .NET4 there is an “error / function” that interferes with [ValidateInput (false)]. You should also disable requestPathInvalidCharacters, validateRequest and requestFiltering with requestValidationMode 2.0:

 <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters="" /> 

Answer 2

I made three changes to solve this problem:

1)

 <system.web> <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters="" /> </system.web> 

2)

 <system.webServer> <security> <requestFiltering allowDoubleEscaping="true" /> </security> </system.webServer> 

3) <pages validateRequest="false" />