Validation detected dangerous client input - post from TinyMCE in ASP.NET

Question

I get this error when I post from TinyMCE in an ASP.NET MVC view.

Error:

Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted

From googling, it says to just add a validateRequest in the Page directive at the top which I did, but I STILL get this error. As you can see, below is my code in the view:

<%@ Page validateRequest="false" Title="" Language="C#" MasterPageFile="~/Views/Shared/Site.Master" Inherits="System.Web.Mvc.ViewPage" %>

score 9 · Answer 1 · edited Feb 06 '13 at 18:15

9

Try this solution. simply add to TinyMce control

tinyMCE.init({
...
encoding : "xml"
});

http://wiki.moxiecode.com/index.php/TinyMCE:Configuration/encoding

http://blog.tentaclesoftware.com/archive/2010/07/22/96.aspx

edited Feb 06 '13 at 18:15

LeftyX

35,328
21
132
193

answered Dec 16 '10 at 09:13

GibboK

71,848
143
435
658

unfortunately tinymce 4 seems to have dropped this – Matthew Lock Oct 17 '13 at 03:46

score 5 · Answer 2 · edited Aug 30 '12 at 13:42

5

Try using the [AllowHtml] attribute in your model.

class MyModel{
 [AllowHtml]
 public string Content{get;set;}
}

edited Aug 30 '12 at 13:42

ЯegDwight

24,821
10
45
52

answered Mar 03 '12 at 11:03

Volodymyr Boryslavskyi

51
1
2

score 4 · Accepted Answer · answered Aug 04 '09 at 02:25

4

Use the decorator [ValidateInput(false)].

You will then want to write a HTMLEncode method to make it safe.

Let me know if you want me to post the one I use.

Added the Encode I use

    public static class StringHelpers
{
    public static string HtmlEncode(this string value)
    {
        if (!string.IsNullOrEmpty(value))
        {
            value = value.Replace("<", "&lt;");
            value = value.Replace(">", "&gt;");
            value = value.Replace("'", "&apos;");
            value = value.Replace(@"""", "&quot;");
        }
        return value;
    }

    public static string HtmlDecode(this string value)
    {
        if (!string.IsNullOrEmpty(value))
        {
            value = value.Replace("&lt;", "<");
            value = value.Replace("&gt;", ">");
            value = value.Replace("&apos;", "'");
            value = value.Replace("&quot;", @"""");
        }

        return value;
    }
}

answered Aug 04 '09 at 02:25

griegs

22,624
33
128
205

if you can post that would be great – leora Aug 04 '09 at 02:26
thanks.. that worked great. is there anyway to prepoulate the textarea from an existing html page – leora Aug 04 '09 at 02:35
Don't quite understand what you mean [me]. Are you talking about screen scraping here or... – griegs Aug 04 '09 at 02:40
4

Worth noting two things if using VS2010 and ASP.NET MVC2. First of all, you need to put within in your web.config file for the [ValidateInput(false)] attribute to work. Secondly, the above encoder is far too naive to be reliable. – Ant Aug 16 '10 at 13:35
5

What's wrong with using `HttpUtility` for `HtmlEncode`/decode rather than writing your own? – Dan Atkinson Dec 25 '10 at 23:08

score 0 · Answer 4 · edited May 23 '17 at 11:45

0

Annoyingly in version 4 of tinymce they seem to have removed the encoding: xml option.

I ended up using a javascript HTML encoding function from this answer, and on my submit button I encode the contents of the textarea before the form submits, by using tinymce's getContent and setContent methods

edited May 23 '17 at 11:45

Community

1
1

answered Oct 01 '13 at 03:50

Matthew Lock

13,144
12
92
130

1

I think it's risky to depend solely on client side encoding, as it doesn't prevent an evildoer from POSTing directly to your site. You have to sanitize inputs on the server as well. – Eric Nelson Jul 04 '16 at 04:32
Yes it's important to always remember that – Matthew Lock Jul 04 '16 at 06:11

xatz · Answer 5 · 2015-04-09T15:52:28.870

I had the same problem. I didn't want to disable ASP.NET MVC validation feature, so I kept looking until I reached this solution:

At the tinyMCE plugin code encode your content (I'm using the older version)

tinyMCE.init({
   ...
   encoding: "xml"
});

And after this I didn't get any more the application validation error. Then I came up with another problem when I edited my form the code would come up with the html tags

<strong>My input value</strong>

instead of this

My input value

So, I had to decode the html for that field when getting my values at the Controller, like this:

...    
entity.field = HttpUtility.HtmlDecode(entity.field);

Validation detected dangerous client input - post from TinyMCE in ASP.NET

5 Answers5

Linked