Asp Mvc Handling Error when entering HTML in form

Question

Is it possible to handle the A potentially dangerous Request.Form value was detected from the client (Model.Title="<p>some text</p>"). system wide? Answers in this question suggest to add some validation on each attribute. I don't want to do that. Is it possible to redirect the user back to the form with an error message telling them they entered invalid input?

Edit: To clarify, I don't want to accept the HTML, I just want to show the user a friendly error message (like the ones for the validation of attributes).

Edit2: I know I can add attributes to my properties to allow HTML or disable the validation. Since there are a lot of forms, I don't want to pollute al my properties with [AllowHtml] or disable the validation (because I need validation). I'm looking for a way to intercept the MVC-flow and catch this error when it gets triggered.

possible duplicate of A potentially dangerous Request.Form value was detected from the client — greg84
– greg84, Commented Apr 20, 2015 at 9:20
@greg84: I don't want to accept the input. I just want to know if there is an easy way to catch this specific error. — Thijs
– Thijs, Commented Apr 20, 2015 at 9:25

Steven Lemmens · Accepted Answer · 2015-04-20 09:28:55Z

1

If you don't want to accept the HTML, I think the only way is to allow the HTML to be submitted, and then check for the presence of any HTML tags server-side. If found, you would then return your user to the form with code like this:

if (input.Contains("<")) {
   Model.AddModelError("HTML_FOUND", "There is HTML in your input. Please remove the HTML before trying to submit again");
   return View();
}

It's probably possible to implement this system-wide by using a Filter https://msdn.microsoft.com/en-us/library/gg416513%28VS.98%29.aspx

answered Apr 20, 2015 at 9:28

Steven Lemmens

6305 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Thijs Over a year ago

Before entering the controller the error gets thrown so this code is unreachable unless I provide each property with [AllowHtml]-attributes (which I don't want to do).

Thijs Over a year ago

There it is! I didn't knew about filters. I'll check it out and accept when I got it working. Thnx!

chenZ · Accepted Answer · 2015-04-20 09:34:41Z

0

option 1

[ValidateInput(false)]

add this on your action,this will disable all field html check.
option 2

[AllowHtml]

add this on the property you want allow html.this will only allow that property contains html,others not. but,if you action like

public ActionResult Index(FormCollection form)

option 2 not work,you must use

public ActionResult Index(ModelXXX model)

because,this will use the modelbinder,and FormCollection not .

answered Apr 20, 2015 at 9:34

chenZ

9404 silver badges16 bronze badges

Collectives™ on Stack Overflow

Asp Mvc Handling Error when entering HTML in form

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related