A potentially dangerous Request.Path value was detected from the client (:)

Question

I am trying to fetch some English Translation of Quran from quran.com for a university project using the following link:

http://quran.com/quran/ajax?s=1&sA=1&eA=8&l=12C6

This link when entered in browser returns proper results but when I try to use this link in my Angular method I get the error:

A potentially dangerous Request.Path value was detected from the client (:)

Angular Method:

Qt.Link = "http://quran.com/quran/ajax?s=1&sA=1&eA=8";
Qt.GetTranslation = function () {
        $http.get("/"+Qt.Link).success(function (result) {
            Qt.display = result;
        }).error(function (data) {
            toastr["error"](data);

        });
    };

After searching on the internet I found out that this is because of some invalid characters in the URL or because of not passing the parameter correctly like shown here.

If the link works in the browser why doesn't it work with the Angular method?
How can I fix this?

Any help will be appreciated. Thank You

could you try logging exactly what's in the variable Qt.Link? (before doing the http.get) — Steven Lemmens, Jun 29 '15 at 14:26
are you sure your & and ? don't get escaped? you might have to pass the s, A, eA and I as get parameters `{eA:8,s:1,sA:1,l:"12C6"}` — Tschallacka, Jun 29 '15 at 14:28
What Michael Dibbets said, and also try removing the "/" in front of Qt.Link. — Steven Lemmens, Jun 29 '15 at 14:28
@StevenLemmens I tried removing the "/" but it didn't work and I got no response... — Syed Farjad Zia Zaidi, Jun 29 '15 at 14:29
@SyedFarjadZiaZaidi CORS Error in the console after removing the `/` ? — Hacketo, Jun 29 '15 at 14:30
@Hacketo I get this error after removing the "/" in the console: `XMLHttpRequest cannot load http://quran.com/quran/ajax?s=1&sA=1&eA=8. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3855' is therefore not allowed access.` — Syed Farjad Zia Zaidi, Jun 29 '15 at 14:33

score 5 · Accepted Answer · answered Jun 29 '15 at 14:35

What $http.get("/"+Qt.Link) will try to load is:

/http://quran.com/quran/ajax?s=1&sA=1&eA=8

That leading / means it will try to load it from your server.

To get http://quran.com/quran/ajax?s=1&sA=1&eA=8, remove the /.

Note that if this is client-side (as it seems to be), you may run into the Same Origin Policy, which only allows XHR requests within an origin unless the target of the request specifically supports Cross-Origin Resource Sharing and shares with your origin (or all origins).

If that service is meant to be used from client-side code, they'll have a page telling you how to do it (JSONP or similar). If it's not, you'll have to send a query to your server with that as a parameter, and have your server do the request to quran.com and then send you back the response.

A potentially dangerous Request.Path value was detected from the client (:)

1 Answers1