A potentially dangerous Request.Path value was detected from the client (?) in asp mvc

Question

i have seen similar question in SO, and i tried them but dont know why it didnt meet my requirement

i get this error in website, actually our site works this way, when a users click a product on our site, we redirect them to another site

and in sql db, column site is stored this way : http://another.com/

so when user clicks the button in our site, this works fine, he is redirected another.com

but when i change site column in sql db to http://another.com/GiftPack/PackageDetail?packageid=41

i get this error with following url in our site

http://oursite.com/Product/90/httpcolonslashslashanotherdotscom/GiftPack/PackageDetail%3fpackageid%3d41

this what i tried thus far:

from here and here

in controller:

[HttpPost]
[ValidateInput(false)]
public ActionResult Product(int prodid, string site)
{
return Redirect(site.Replace("colon", ":").Replace("slashslash", "//").Replace("dots", ".")
.Replace("%3D", "=").Replace("%3F", "?").Replace("slash", "/"));
}

in web.config

 <httpRuntime targetFramework="4.5" requestValidationMode="2.0" 
 requestPathInvalidCharacters="*,:,&amp;,\,?,=" relaxedUrlToFileSystemMapping="true"/>

may i know what wrong i am doing, any help would be great.

i tried `[AllowHtml]` in my model property in class [here](http://stackoverflow.com/a/7306222/2218697), but still same error with `:` — Shaiju T, Apr 02 '15 at 12:52
i have updated my return redirect by using url re-write for `?,=,/` from [here](http://stackoverflow.com/questions/19530880/iis-url-rewrite-for-url-link-with-3d), does anyone have any idea ? — Shaiju T, Apr 02 '15 at 12:56
I have never seen .NET html encode `http://` to `httpcolonslashslash`. Where is this coming from? — Tommy, Apr 02 '15 at 13:20
@Tommy, i have just replaced `//`, you can check the `return Redirect` it works for 'http://another.com/' but for `http://another.com/GiftPack/PackageDetail?packageid=41` it gives the error, hope you read my question — Shaiju T, Apr 02 '15 at 13:30
I did read your question. I still don't understand how this `http://another.com/GiftPack/PackageDetail?packageid=41` is turning into this `httpcolonslashslashanotherdotscom/GiftPack/PackageDetail%3fpackageid%3d41`. Also, to answer your question, since you are sending the product id into your action method, just pull the DB record of the product and redirect to the product URL from that method. No longer are you doing some weird translations on URLs. — Tommy, Apr 02 '15 at 13:38
@Tommy, i did that before , `return Redirect(site);` , but resulted in same error, gonna give try with `return new RedirectResult("yourURL", true); ` — Shaiju T, Apr 02 '15 at 13:56
@Tommy, now it is working i used `Replace` method, thank you. — Shaiju T, May 06 '15 at 16:10

score 0 · Accepted Answer · edited May 23 '17 at 12:14

finally this worked for me using Replace method

in controller:

public ActionResult Product(int prodid, string site)
{
return Redirect(site.Replace("colon", ":").Replace("slashslash", "//").Replace("dots", 
".").Replace("slash", "/").Replace("ques", "?").Replace("equal", "="));
}

in view:

<a target="_blank" class="btn btn-sm" href="@Url.Action("Product/" + pro.prodid
+ "/" + pro.site.Replace(".", "dots").Replace(":", "colon").Replace("//", "slashslash")
.Replace("=", "equal").Replace("?", "ques").Replace("/","slash"))">
Click to Go</a>

Note: pro is the element name inside my foreach loop

for more you can check this,

hope this helps someone.

A potentially dangerous Request.Path value was detected from the client (?) in asp mvc

1 Answers1