2

According to this link, now we can use Request.Unvalidated to access a raw value of a form field wihout triggering request validation (and see dreadful error message A potentially dangerous Request.Form...). Unfortunately I could not get it work.

Web.config

<httpRuntime targetFramework="4.5" requestValidationMode="4.5" />

A simple field in view model:

// [AllowHtml] - even I tried this, it still did not work :(
public string Description { get; set; }

And controller action:

[HttpPost]
public ActionResult Edit([Bind(Prefix = "Edit")] EditModel model)
{
  string s = Request.Unvalidated.Form["Edit.Description"];
}

I still see error "A potentially dangerous Request.Form...", why? Tried google but there was no example with ASP.NET MVC.

Toolbox: I'm working with a ASP.NET MVC 4 project, targetting .NET 4.5, and VS2012.

Thanks,

UPDATE: Using AllowHtml with Description property fixed my problem, even don't need Request.Unvalidated. There is still an issue as I commented below in @webdeveloper's answer.

4 Answers 4

8

Look at this links:

They will help you to understand, how does it works.

4
  • Is there anything wrong with my code? Error appeared before Edit action was reached.
    – Tien Do
    Oct 10, 2012 at 18:22
  • @Tiendq It falls on binding, the idea of Unvalidated is that you can access fields with potentially dangerous Request.Form, but here Edit([Bind(Prefix = "Edit")] EditModel model) binder works without Unvalidated. Oct 10, 2012 at 18:52
  • Thanks, I fixed it with HtmlAllow. But as you said, is there any chance to use both model binding and Request.Unvalidated?
    – Tien Do
    Oct 11, 2012 at 18:16
  • @Tiendq I am not sure, that it can be done, but the simplest way to test it, is debug mvc framework, like here: stackoverflow.com/questions/4651085/… Oct 11, 2012 at 20:19
1

It looks like you need to set the request validation mode to 2.0 as described in webdeveloper's first link. Try this:

<httpRuntime targetFramework="4.5" requestValidationMode="2.0" />
1
  • Sad as this sounds, it still seems like the best solution to manage request validation effectively. Ever since 4.0 request validation has been a nightmare in ASP.NET since the config value is global and even Request.Unvalidated doesn't solve this problem properly. Feb 5, 2013 at 17:39
1

I know the problem is already has been solved by @webdeveloper. But, for more information about requestValidationMode.

For Example: it can be either 2.0 or 4.0.

<httpRuntime targetFramework="4.5" requestValidationMode="2.0" />

or

<httpRuntime targetFramework="4.5" requestValidationMode="4.0" />

This Request validation is enabled only for pages. The following content is from the reference of MSDN

  • 4.0 (the default). The HttpRequest object internally sets a flag that indicates that request validation should be triggered whenever any HTTP request data is accessed. This guarantees that the request validation is triggered before data such as cookies and URLs are accessed during the request. The request validation settings of the pages element (if any) in the configuration file or of the @ Page directive in an individual page are ignored.

  • 2.0 Request validation is enabled only for pages, not for all HTTP requests. In addition, the request validation settings of the pages element (if any) in the configuration file or of the @ Page directive in an individual page are used to determine which page requests to validate.

The value that you assign to this property is not validated to match a specific version of ASP.NET. Any numeric value smaller than 4.0 (for example, 3.7, 2.9, or 2.0) is interpreted as 2.0. Any number larger than 4.0 is interpreted as 4.0.

So defining requestValidationMode="4.5" initially will be interpreted to requestValidationMode="4.0".

0

This problem due to model binder. For your code you need to exclude property "Description" from model binging. Another way to allow html in property, you can use [AllowHtml] attribute in propery in your view model

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.