asp.net-mvc-2 – 检测到一个有潜在危险的request.form值,但vali

发布时间：2020-12-16 07:33:45 所属栏目：asp.Net 来源：网络整理

导读：我已经安装了VS2010和MVC2并使用tinyMCE测试了一个简单的表单.当我在tinyMCE中发布textarea的内容时,我得到了可怕的YSD和消息 “a potentially dangerous…..” 我以前见过这个,所以我把ValidateInput(false)放在控制器上,但没有快乐 – 我仍然得到错误. edi

我已经安装了VS2010和MVC2并使用tinyMCE测试了一个简单的表单.当我在tinyMCE中发布textarea的内容时,我得到了可怕的YSD和消息

“a potentially dangerous…..”

我以前见过这个,所以我把ValidateInput(false)放在控制器上,但没有快乐 – 我仍然得到错误.

edit.aspx中的页面代码是：

<% using (Html.BeginForm()){ %>

    <!-- Gets replaced with TinyMCE,remember HTML in a textarea should be encoded -->
    <textarea id="elm1" name="mceText" rows="15" cols="80" style="width: 80%">
        &lt;p&gt;
            This is some example text that you can edit inside the
  &lt;strong&gt; TinyMCE editor&lt;/strong&gt;.
    </textarea>

    <br />
    <input type="submit" name="save" value="Submit" />
    <input type="reset" name="reset" value="Reset" />
<%} %>

和控制器的行动是：

[AcceptVerbs(HttpVerbs.Post)]
    [ValidateInput(false)]
    public ActionResult Edit(string mceText)
    {

        return View();
    }

任何想法 – (我知道代码不完整)已经尝试了几个小时,但每个人只是说使用ValidateInput(false)

解决方法

这就是为什么： http://www.asp.net/learn/whitepapers/aspnet4/breaking-changes#0.1__Toc256770147

The request validation feature in ASP.NET provides a certain level of
default protection against cross-site scripting (XSS) attacks. In
previous versions of ASP.NET,request validation was enabled by
default. However,it applied only to ASP.NET pages (.aspx files and
their class files) and only when those pages were executing.

In ASP.NET 4,by default,request validation is enabled for all
requests,because it is enabled before the BeginRequest phase of an
HTTP request. As a result,request validation applies to requests for
all ASP.NET resources,not just .aspx page requests. This includes
requests such as Web service calls and custom HTTP handlers. Request
validation is also active when custom HTTP modules are reading the
contents of an HTTP request.

As a result,request validation errors might now occur for requests
that previously did not trigger errors. To revert to the behavior of
the ASP.NET 2.0 request validation feature,add the following setting
in the Web.config file:

<httpRuntime requestValidationMode="2.0" />

However,we recommend that you analyze any request validation errors to determine whether existing handlers,modules,or other custom code accesses potentially unsafe HTTP inputs that could be XSS attack vectors.

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!