Umbraco 7 MVC - Request.Form gives me dangerous request error

Question

In the shopping basket of my site, i need to allow a form POST of XML coming from a third-party service.

The possible solutions i can find is for webforms and < Umbraco 7. I'm aware that you can disable page validation entirely, but that's not an option in my case.

Does someone know the equivalent way of using the control <umbraco:DisableRequestValidation runat="server"/> in MVC?

score 3 · Answer 1 · answered Feb 23 '18 at 10:47

for security reason, I would suggest try use [AllowHtml] on property which would contain the xml content

so say you viewmodel has property call ThirdPartyContent which will have xml:

    public class VM
    {
        public string Name { get; set; }
        [AllowHtml]
        public string ThirdPartyContent { get; set; }
    }

this implicit state which property you are aware will contain potential malicious content (which is angle bracket)

[ValidateInput(false)] does the trick but will assume all property may contain xml content which may not be good thing

more info checkout this SO answer which say the difference between [AllowHtml] and [ValidateInput(false)]

ValidateInput(false) vs AllowHtml

score 1 · Answer 2 · answered Feb 23 '18 at 09:03

I found the answer to my own question. It's possible to set the [ValidateInput(false)] annotation on RenderMvcControllers. So you can do it per document type which is kinda nice.

I'll leave the answer here in case someone else needs to do the same thing.

Umbraco 7 MVC - Request.Form gives me dangerous request error

2 Answers2