how can we apply client side validation on fileupload control in ASP.NET to check filename contain special character?

Question

I am working on ASP.NET3.5 platform. I have used a file upload control and a asp button to upload a file. Whenever i try to upload a file which contain special characterlike (file#&%.txt) it show crash and give the messeage

--------------------------------------------------------------------------------
Server Error in 'myapplication' Application.
--------------------------------------------------------------------------------

A potentially dangerous Request.Files value was detected from the client 
 (filename="...\New Text &#.txt").
Description: Request Validation has detected a potentially dangerous client input
value, and processing of the request has been aborted. This value may indicate an
attempt to compromise the security of your application, such as a cross-site 
scripting attack. You can disable request validation by setting 
validateRequest=false in the Page directive or in the configuration section. 
However, it is strongly recommended that your application explicitly check all 
inputs in this case. 

Exception Details: System.Web.HttpRequestValidationException: A potentially 
dangerous Request.Files value was detected from the client 
      (filename="...\New Text &#.txt").

Source Error: 

An unhandled exception was generated during the execution of the current web 
request. Information regarding the origin and location of the exception can be
identified using the exception stack trace below.  

--------------------------------------------------------------------------------

how can i prevent this crash using javascript at client side?

TheVillageIdiot · Accepted Answer · 2010-05-24T08:50:11.543

2

A very simple solution is to validate the filename on click of the button (or some other control) that triggers upload like this and stop upload if there is some problem with filename:

<asp:FileUpload ID="fu1" runat="server" />
<asp:Button ID="btn" runat="server" CausesValidation="true" Text="Click" 
           OnClientClick="return ValidateFileName();" /> 

<script type="text/javascript">
    function ValidateFileName() {
        var fu = document.getElementById("<%= fu1.ClientID %>");
        var f = fu.value + "";
        if ((f.indexOf("#", 0) >= 0) || (f.indexOf("$", 0) >= 0) ||
              (f.indexOf("%", 0) >= 0) || (f.indexOf("^", 0) >= 0)) {
            alert("Filename: [" + f + "] contains invalid char");
            return false;//will stop button click event here
        }

        return true;
    }
</script>

edited May 24 '10 at 08:50

answered May 24 '10 at 06:43

TheVillageIdiot

40,053
20
133
188

my dear ur simple solution does not work.You can run the code on your machine and then send the answer.And i does not understand the code if(f.indexOf("A",0)>=0) – Subbu May 24 '10 at 06:52
@subodh `f.indexOf("A",0)` is to check if letter 'A' is in the file name. 'A' is just fo illustration, you can change it to what ever char you want to look in the file name. It works and I had tested it on my machine :D – TheVillageIdiot May 24 '10 at 07:01
I have to search for a group of character like #$%^ how can we search that? – Subbu May 24 '10 at 07:16

score 0 · Answer 2 · edited May 23 '17 at 11:47

0

In an answer similar your other question, you cannot "know" the filename of the files that are being uploaded on the client side, because the browser does not let the javascript see that. As I said on that question, you can use something like SWFupload to give you a bit more control on the client-side and detect this if you like.

You can also take a look at this question for some ideas on how to disable the validation on the server-side.

edited May 23 '17 at 11:47

Community

1
1

answered May 24 '10 at 06:24

Dean Harding

71,468
13
145
180

then how can we validate a particular extension is allowed to upload with the help of java script if we cant know the filename of the file at client side? will u please clear my doubt? – Subbu May 24 '10 at 06:28

score 0 · Answer 3 · answered May 24 '10 at 07:54

The ASP.NET page validation just allows you to be lazy and not bother checking your inputs for characters which COULD be used for some sort of attack. However, if you're following good programming practices such as Html.Encode-ing things you display and using parameters for SQL queries, this validation is a lot less useful and I find gets in the way!

Disable it for your file upload page by setting validateRequest=false in the page directive. Just make sure you are checking any other values being entered on that page.

how can we apply client side validation on fileupload control in ASP.NET to check filename contain special character?

3 Answers3