I tried to find a solution to this problem whole day.
Disabling validation was not an option.
Adding allowHtml was not an option either, because by msdn specification:
AllowHtmlAttribute allows a request to include HTML markup during model binding by skipping request validation for the property. source
Also, there are a lot of properties with string attributes within a project that should be validated if the default validation is set to false.
Solution:
I have created a CustomRequestValidation class:
public class CustomRequestValidation : System.Web.Util.RequestValidator
{
protected override bool IsValidRequestString(HttpContext context, string value, RequestValidationSource requestValidationSource, string collectionKey, out int validationFailureIndex)
{
validationFailureIndex = -1;
if (requestValidationSource == RequestValidationSource.RawUrl)
return true;
if (requestValidationSource == RequestValidationSource.Form)
{
var isValid = base.IsValidRequestString(context, value, requestValidationSource, collectionKey, out validationFailureIndex);
if (!isValid)
{
validationFailureIndex = -1;
return true;
}
}
return base.IsValidRequestString(context, value, requestValidationSource, collectionKey, out validationFailureIndex);
}
}
what it does is that it simply skips RequestValidation for the purpose of reaching model state.
Next I have overriden the default model binder:
public class CustomModelBinder : DefaultModelBinder
{
protected override bool OnPropertyValidating(ControllerContext controllerContext, ModelBindingContext bindingContext, System.ComponentModel.PropertyDescriptor propertyDescriptor, object value)
{
if (value != null)
{
if (propertyDescriptor.PropertyType == typeof(string))
{
string val = value.ToString();
int validationIndex;
var isValid = new System.Web.Util.RequestValidator().InvokeIsValidRequestString(controllerContext.HttpContext.ApplicationInstance.Context, val, RequestValidationSource.Form, null, out validationIndex);
if (!isValid && !propertyDescriptor.Attributes.OfType<AllowHtmlAttribute>().IsAny())
{
var key = CreateSubPropertyName(bindingContext.ModelName, propertyDescriptor.Name);
bindingContext.ModelState.AddModelError(key, ErrorConstants.SpecialCharacters);
}
}
}
return base.OnPropertyValidating(controllerContext, bindingContext, propertyDescriptor, value);
}
}
Now here we do all the validation. In model binder I call the default .Net IsValidRequestString method along with a check if AllowHtml was set and I set the model state accordingly. It gives me control over the data and I can go back to the page and fill back the form with previously entered data without firing off inserted scripts. I am using strongly-typed models.
FormCollection
thing. MVC adds this automatically when generating an action Method for you. this FormCollection contains ALL postback material. you can easily do this:public ActionResult AddNews(FormCollection col, News news){
although that doesnt fix your problem. and when you dont need anything besides the news, you probably can remove theFormcollection
FormCollection
when using[AllowHtml]
. you then should use yourNews news