asp.netvalidationashxgeneric-handlerdangerous-request

"Potentially Dangerous Request.Form" Exception in a generic handler

I've seen this error before but cannot seem to get around it. In this case, I have an ASHX page spitting out a simple HTML form with a textbox into which XML may be posted. When I try to read the form, I receive the "A potentially dangerous Request.Form value...".

Since it's a generic handler the "ValidateRequest" attribute isn't available. However I already had this defined in web.config:

<location path="xml/MyGenericHandler.ashx">
    <system.web>
      <pages validateRequest="false" />
    </system.web>
</location>

This snippet predates a move from .NET 3.5 to 4.0 so I'm guessing that's where the breakage originated.

Any idea how to get around this error for ASHX pages?

Solution

  • The 3.5-4.0 change that clipped you was some stepped up runtime security features for ASP.NET 4.0. The quick fix is to apply the following attribute:

    <httpRuntime requestValidationMode="2.0" />

    Unfortunately, that opens all pages up to 2.0 request validation, so I'd only do this if you've got a relatively small attack surface.