I use Summernote to enable users to write an HTML email on my website. The email is submitted if the user submits the Form. Since the Email is a little more complex with some additional data I use a custom ModelBinder which leads me to my problem.
I try to get the Email text like this
argument = request.Form[propertyName] //<-- HttpRequestBase request;
The FreeMessageModel looks like this.
public class FreeMessageModel : BaseMessageModel
{
private MvcHtmlString m_FreeMessage;
private String m_Subject;
private EmployeeModel m_Employee;
public MvcHtmlString FreeMessage
{
get
{
return m_FreeMessage;
}
set { m_FreeMessage = value; }
}
public String Subject
{
get { return m_Subject; }
set { m_Subject = value; }
}
public EmployeeModel Employee
{
get { return m_Employee; }
set { m_Employee = value; }
}
public String Sender
{
get
{
String from = "someadress");
return from;
}
}
public FreeMessageModel()
{
}
public string GetMailBody()
{
throw new NotImplementedException();
}
}
The request.Form[propertyName]
crashes on FreeMessage
with the error Message HttpRequestValidationException.
I am aware that the HTML text is interpreted as possible security issue. My question is how can I get the text so that I can decide if its dangerous myself ?
I read this Why do I get HttpRequestValidationException submitting user input with raw html? but this happens after the Modelbinding process.
So the question is How can I get HTML text during ModelBinding without getting a HttpRequestValidationException and without turning off the validation for my whole application
I am using the .Net Framework 4.0