1

Is it possible to handle the A potentially dangerous Request.Form value was detected from the client (Model.Title="<p>some text</p>"). system wide? Answers in this question suggest to add some validation on each attribute. I don't want to do that. Is it possible to redirect the user back to the form with an error message telling them they entered invalid input?

Edit: To clarify, I don't want to accept the HTML, I just want to show the user a friendly error message (like the ones for the validation of attributes).

Edit2: I know I can add attributes to my properties to allow HTML or disable the validation. Since there are a lot of forms, I don't want to pollute al my properties with [AllowHtml] or disable the validation (because I need validation). I'm looking for a way to intercept the MVC-flow and catch this error when it gets triggered.

Community
  • 1
  • 1
Thijs
  • 3,015
  • 4
  • 29
  • 54
  • possible duplicate of [A potentially dangerous Request.Form value was detected from the client](http://stackoverflow.com/questions/81991/a-potentially-dangerous-request-form-value-was-detected-from-the-client) – greg84 Apr 20 '15 at 09:20
  • @greg84: I don't want to accept the input. I just want to know if there is an easy way to catch this specific error. – Thijs Apr 20 '15 at 09:25

2 Answers2

1

If you don't want to accept the HTML, I think the only way is to allow the HTML to be submitted, and then check for the presence of any HTML tags server-side. If found, you would then return your user to the form with code like this:

if (input.Contains("<")) {
   Model.AddModelError("HTML_FOUND", "There is HTML in your input. Please remove the HTML before trying to submit again");
   return View();
}

It's probably possible to implement this system-wide by using a Filter https://msdn.microsoft.com/en-us/library/gg416513%28VS.98%29.aspx

Steven Lemmens
  • 620
  • 5
  • 18
  • Before entering the controller the error gets thrown so this code is unreachable unless I provide each property with `[AllowHtml]`-attributes (which I don't want to do). – Thijs Apr 20 '15 at 09:32
  • There it is! I didn't knew about filters. I'll check it out and accept when I got it working. Thnx! – Thijs Apr 20 '15 at 09:41
0

option 1

[ValidateInput(false)]

add this on your action,this will disable all field html check.
option 2

[AllowHtml]

add this on the property you want allow html.this will only allow that property contains html,others not. but,if you action like 

public ActionResult Index(FormCollection form)

option 2 not work,you must use

public ActionResult Index(ModelXXX model)

because,this will use the modelbinder,and FormCollection not .

chenZ
  • 920
  • 4
  • 16