Cannot post html when running on amazon-ec2 with mono and mvc3

Question

I have a site hosted on an Amazon Linux AMI box running mono through lighttpd. In the admin section of my site, I have a form that let's me create blog entries. Since I want to be able to store html, I set up my save controller action as follows:

[Authorize(Roles = "Admin")]
[HttpPost, ValidateInput(false)]
public ActionResult CreateBlog(Blog model) {
    if (ModelState.IsValid) {
        ContextFactory.BlogManager.Save(model);
        return RedirectToAction("Blogs");
    }
    return View(model);
}

Everything works fine locally, but when I deploy the code to our amazon instances, I get the following exception:

A potentially dangerous Request.Form value was detected from the client (Body=\"asd<br>asdas\").
System.Web.HttpRequestValidationException: A potentially dangerousr> Request.Form value was detected from the client (Body=\"asd<br>asdas\").<br>
 at System.Web.HttpRequest.ThrowValidationException (System.String name, System.String key, System.String value) [0x00000] in <filename unknown>:0 <br>
  at System.Web.HttpRequest.ValidateString (System.String key, System.String value, RequestValidationSource source) [0x00000] in <filename unknown>:0 <br>
  at Microsoft.Web.Infrastructure.DynamicValidationHelper.LazyWebROCollection.Validate (System.String key, System.String value) [0x00000] in <filename unknown>:0 <br>
  at Microsoft.Web.Infrastructure.DynamicValidationHelper.LazyWebROCollection.Get (System.String name) [0x00000] in <filename unknown>:0 <br>
  at System.Collections.Specialized.NameValueCollection.get_Item (System.String name) [0x00000] in <filename unknown>:0 <br>
  at ...

Any ideas?

score 2 · Accepted Answer · answered May 12 '11 at 13:04

2

I was actually able to fix it by adding <httpRuntime requestValidationMode="2.0"/> to my web.config

answered May 12 '11 at 13:04

Ryan Caskey

607
8
20

score 0 · Answer 2 · edited May 23 '17 at 11:47

0

It sounds like the data that's getting posted back contains a <. This is disallowed to prevent possible script injection attacks. Here's a previous question on the topic that should be able to help you ou.

edited May 23 '17 at 11:47

Community

1
1

answered May 12 '11 at 00:50

ataddeini

4,931
26
34

Yes, but as mentioned in my post, I specifically wanted to post HTML, and that's why I added the ValidateInput(false) to my controller. I was actually able to fix it by adding to my web.config. I'l mark this as answered when the system lets me, looks like there's an 8 hour cap. – Ryan Caskey May 12 '11 at 05:11
@rsparkyc: Ah right, sorry I missed that. Glad you were able to resolve it. – ataddeini May 12 '11 at 12:14

Cannot post html when running on amazon-ec2 with mono and mvc3

2 Answers2