How to disable request validation in ASP.NET MVC, IIS Express

Question

.Net Framework 4.5.2, Visual Studio 2015, IIS Express

I want to send requests like http://localhost:49974/xxx/xml/<a><b></b></a> to my application. This results in a server error and the message: A potentially dangerous Request.Path value was detected from the client (="/xxx/xml/<a><b></b></a>").

Following the instructions from MSDN I have set requestValidationMode="2.0":

<system.web>
  <httpRuntime requestValidationMode="2.0" targetFramework="4.5.2" />
</system.web>

And and added [ValidateInput(false)] to cotrtoller's action:

[ValidateInput(false)]
public ActionResult Xml()
{
    return View("../Home/Index");
}

However I still get exactly the same error on the request presented above.

middelpat · Accepted Answer · 2016-10-29 11:41:00Z

2

If you are able to convert the acionmethod to use a model for receiving the data, you can specify the [AllowHtml] Attribute on the modelproperty.

This also ensures that the validation is only skipped for this specific property.

ActionMethod:

public ActionResult Xml(XmlModel vm)
{
    return View("../Home/Index");
}

Model

public class XmlModel
{
    [AllowHtml]
    public string xml { get; set; }
}

your url would look like http://localhost:49974/xxx/xml/?xml={your xml string}

edited Oct 29, 2016 at 11:41

answered Oct 29, 2016 at 9:11

middelpat

2,5851 gold badge22 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

inwenis Over a year ago

ok I see, but is there any way to configure the validation of the URI? I know sending a XML in URI is a bad idea but it's the simplest thing I could think of and I would like to make it work.

middelpat Over a year ago

In my experience i've found that allowing this using a model works best and is a safer way than disabling requestvalidation on your entire method / application. It is still possible to send the xmldata through the url. See my editted answer for an example

Collectives™ on Stack Overflow

How to disable request validation in ASP.NET MVC, IIS Express

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related