14

What's the best way to handle errors such as

A potentially dangerous Request.Form value was detected from the client"

in ASP.NET?

I'd like to keep the validation on, as my forms have no valid reasons to be allowing HTML characters. However, I'm not quite sure how to handle this error in a more friendly manner. I tried handling it in a Page_Error but, as far as I can tell, this occurs in a lower level section so the Page_Error function never fires.

Therefore, I may have to resort to using Application_Error in my Global.asax file. If this is the only way of handling that error, is there a way of specifically handling that one error? I don't want to handle all application errors in the same manner.

Thanks

AlexB
  • 7,302
  • 12
  • 56
  • 74
keyboardP
  • 68,824
  • 13
  • 156
  • 205

3 Answers3

22

You have two options:

// Editing your global.asax.cs
public class Global : System.Web.HttpApplication
{
    protected void Application_Error(object sender, EventArgs e)
    {
        Exception lastError = Server.GetLastError();
        if (lastError is HttpRequestValidationException)
        {
            Response.Redirect("~/RequestValidationError.aspx");
        }
    }
}

Or

// Editing your CUser.aspx.cs
public partial class CUser : System.Web.UI.Page
{
    protected override void OnError(EventArgs e)
    {
        Response.Redirect("~/RequestValidationError.aspx");
        Context.ClearError();
    }
}
Rubens Farias
  • 57,174
  • 8
  • 131
  • 162
  • Would [DeterminePostBackmode](http://msdn.microsoft.com/en-us/library/system.web.ui.page.determinepostbackmode%28v=vs.110%29.aspx) as mentioned [here](http://www.codeproject.com/Tips/277509/try-catch-block-around-A-potentially-dangerous-Req) be an alternative solution? [I haven't played with it so I can't tell if it is proper.] – LosManos Dec 30 '14 at 07:50
3

You don't want to go adding unnecessary baggage to the Global.asax. If you're satisfied that this is caused by spurious data input, then deal with the input, no matter where it's coming from:

http://codersbarn.com/post/2008/11/01/ASPNET-Data-Input-Validation.aspx

Concentrate on the cause of the error :-)

IrishChieftain
  • 15,108
  • 7
  • 50
  • 91
  • Thanks for the reply. I'm using regex to handle any input checks, but as a fail-safe, I'd like to have this validation. There may be other exceptions I'd like to handle, this was just one of them to see what the best way to handle them would be. – keyboardP Dec 11 '09 at 20:34
  • Okay, but with regex you cannot pre-determine the format of malicious input. You need to intercept all input end encode it if necessary :-) – IrishChieftain Dec 11 '09 at 21:14
  • 2
    Ah, of course :D! All the input will be sanitized to remove any special characters at all. The regex is from part of a utility class I made, using some of the expressions from this site: http://www.securityfocus.com/infocus/1768 – keyboardP Dec 11 '09 at 22:48
1

You can use Server.GetLastError() in Application_Error to get the exception that was thrown, inspect the exception, and respond as you like to it (redirect to a page, etc)

Dave Swersky
  • 34,502
  • 9
  • 78
  • 118