HttpRequestValidationException for "On="!?!?!?!

[Max Metral]

I use base64 to encode some cookie values. Today I got a "potentially
dangerous cookie value" error. I've isolated it to anything matching this
pattern:

..*On.*=.*

in other words, anything with "On" in it anywhere and an = in it after that
anywhere causes ASP.Net to barf.

This is certainly unacceptable, what am I missing?

 

[Natty Gur]

Hi,

ASP.NET 1.1 request validation catches malicious scripting code in the
Cookie Collection, the QueryString, and Forms Posts. It checks all input
data against a list of potentially dangerous values. ( MSDN -
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspp/
html/scriptingprotection.asp)

obviously on with = is suspicious.



Natty Gur[MVP]

blog : http://weblogs.asp.net/ngur
Mobile: +972-(0)58-888377

 

[Natty Gur]

one more thing

you can set ValdidateRequest to false but I wouldn't recommend it.
Instead you can you can use string replace to replace "on" and "="
sequences in encryption output as part of your encryption method. Then
replace them back to "=" and "on" while decrypting values.

Natty Gur[MVP]

blog : http://weblogs.asp.net/ngur
Mobile: +972-(0)58-888377

 

[Calvin Luttrell/ProjectThunder.com]

Max,
Try turning Validate Page off.
validateRequest=false in the page header in the aspx page. That feature is there to protect you from code injection attacks. Unless you are hosting a site that is a target for malicious behavior I wouldn't worry too much about it. If you can get around the encoding issue that would be better. Trust in God, but tie up the horses.


-Calvin Luttrell
ProjectThunder.com

 

[Max Metral]

I understand what it's TRYING to do, I think it's just a bit dumb about it.
I guess they're trying to squeeze performance, but obviously this is not
malicious:

CookieX=sodiu2039840978SDFH09*#45On029384098s7dfjh2==

that's just binhex... But the On and the = blow it up.

 

[[MSFT]]

hi Max,

It looks to me you are encoding some values and put them in cookies. I
think you make change the arithmetic to avoid "=" in the encoded string. Is
this possible?

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Max Metral]

Yep, now my base64 looks like this:

Convert.ToBase64String(fooArray).Replace('+','-').Replace('/','_').Replace('
=','#')

Quite an adventure.