How to solve this problem?

[Andrew]

Happy new year, friends,

When I tested my asp.net app with a new set of data, I got the following
error:

A potentially dangerous Request.Form value was detected from the client
(TEXTAREA1="...Request = <bitMapMessage type=...").

Description: Request Validation has detected a potentially dangerous client
input value, and processing of the request has been aborted. This value may
indicate an attempt to compromise the security of your application, such as a
cross-site scripting attack. You can disable request validation by setting
validateRequest=false in the Page directive or in the configuration section.
However, it is strongly recommended that your application explicitly check
all inputs in this case.

But, I knew it was just our input text of a TextArea1 box which are
accidently in xml format: e.g. the value in TextArea1 box could be: XML
Request = <bitMapMessage type=0100><acceptorID>......

How can I let my app accept such kind of input info?

Thanks a lot.

 

[Joerg Jooss]

Hello Andrew,

Happy new year, friends,

When I tested my asp.net app with a new set of data, I got the
following error:

A potentially dangerous Request.Form value was detected from the
client (TEXTAREA1="...Request = <bitMapMessage type=...").

Description: Request Validation has detected a potentially dangerous
client input value, and processing of the request has been aborted.
This value may indicate an attempt to compromise the security of your
application, such as a cross-site scripting attack. You can disable
request validation by setting validateRequest=false in the Page
directive or in the configuration section. However, it is strongly
recommended that your application explicitly check all inputs in this
case.

But, I knew it was just our input text of a TextArea1 box which are
accidently in xml format: e.g. the value in TextArea1 box could be:
XML Request = <bitMapMessage type=0100><acceptorID>......

How can I let my app accept such kind of input info?

Turn off request validation for that page (note the last attribute of the
Page directive):

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Foo.aspx.cs" Inherits="Foo"
ValidateRequest="false" %>

Cheers,

 

[Dominick Baier [DevelopMentor]]

Hi,

be very careful when you switch off automatic validation - make sure you
validate every single input if the format is legal.

 

[Joerg Jooss]

Hello Dominick Baier [DevelopMentor],

Hi,

be very careful when you switch off automatic validation - make sure
you validate every single input if the format is legal.

Agreed. There's no point in posting XML content as form data anyway.

Cheers,