Geek Answers Handbook

A potentially dangerous Request.Form ASHX httpHandler value was found

I need to accept the XML data in a form message for my ashx http attack handler.

However, I get the error message “The potentially dangerous value of Request.Form was detected ..” when I pull the xml data from the request using request.Form.

I cannot set the validation request to false, as this is not an aspx page. What can I do?

eg.

<textarea rows="12" cols="50" name="Post2Data"> <root> <XML>.... </root> </textarea> request.Form["Post2Data"];
+4
source share
2 answers

You can add the following entries in web.config.

 <location path="~/YourHandler.ashx"> <system.web> <pages validateRequest="false" /> </system.web> </location> <system.web> <compilation debug="true" targetFramework="4.0"/> <httpRuntime requestValidationMode="2.0" /> </system.web>
+4
source

You can use the Unvalidated property to query, for example

 request.Unvalidated.Form["Post2Data"];

You will need to verify the correctness of the form data yourself. It is not validateRequest = false set validateRequest = false in production environments, as it leaves you vulnerable to cross-site scripting attacks.

+2
source

More articles:


All Articles