2

I understand why the exception " “A potentially dangerous Request.Form value…” occurs and why it's useful. I would like to put client-side validators on my page that check if the input contains < > ON= or whatever else may trigger this exception. The problem is, I don't know all the characters or strings that trigger the exception. Is there a list of the triggers some where? I can't seem to find it, only questions/answers relating to the exception itself and how to handle it.

Also, should a request come from an external source, not my form, how can I tell and how can I handle it? Does Asp.NET do this automatically? Would a hidden field work or can hackers get around that?

An information you can give (including links) is appreciated.

UPDATE:

For anyone interested, I came up with a regex that will match any string with these characters.

(^((?=.*&#).*)$)|(^((?=.*<).*)$)|(^((?=.*>).*)$)

However, when you submit a form, even fields that are in a separate validation group than the button clicked are passed to the server and if any invalid text is in those fields, you get the exception. So, I decided to use an Ajax FilteredTextBoxExtender to block those chars from TextBoxes. Another alternative would be to use a JavaScript keyup function on all the TextBoxes. However, the smart user can disable the JavaScript of both of these and they are not completely reliable.

1
  • Even if You validate on client side You still have to validate it on server side. But I'm not sure what You wan't to achieve. May 21, 2011 at 22:27

1 Answer 1

2

Looks like this is a duplicate of a similar question on this site. This question has several answers where people have reflected through the code to get the actual triggers.

In answer to your other question, if invalid input comes in from a request originating somewhere that you don't explicitly validate, for example another site, it will hit ValidateRequest on the server side of your code and the caller will see a 500 error or your custom error page, if enabled. That's assuming that you allow requests from other servers (read about CSRF). If you don't want to allow requests from other servers you can check the referer of the request and only allow requests from your own site.

1
  • Thank you. I did not see the other question on here, but it breaks it down nicely. :)
    – Lifes
    May 22, 2011 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.