Handle "potentially dangerous Request.Form value..."

Question

What's the best way to handle errors such as

A potentially dangerous Request.Form value was detected from the client"

in ASP.NET?

I'd like to keep the validation on, as my forms have no valid reasons to be allowing HTML characters. However, I'm not quite sure how to handle this error in a more friendly manner. I tried handling it in a Page_Error but, as far as I can tell, this occurs in a lower level section so the Page_Error function never fires.

Therefore, I may have to resort to using Application_Error in my Global.asax file. If this is the only way of handling that error, is there a way of specifically handling that one error? I don't want to handle all application errors in the same manner.

Thanks

Toddy

Can you post your Page tag content? – Supine

<%@ Page Title="" Language="C#" MasterPageFile="~/Main.Master" AutoEventWireup="true" CodeBehind="CUser.aspx.cs" Inherits="TestSite.Test.MasterPage.CUser" %> – Toddy

Answer 1

You have two options:

// Editing your global.asax.cs
public class Global : System.Web.HttpApplication
{
    protected void Application_Error(object sender, EventArgs e)
    {
        Exception lastError = Server.GetLastError();
        if (lastError is HttpRequestValidationException)
        {
            Response.Redirect("~/RequestValidationError.aspx");
        }
    }
}

Or

// Editing your CUser.aspx.cs
public partial class CUser : System.Web.UI.Page
{
    protected override void OnError(EventArgs e)
    {
        Response.Redirect("~/RequestValidationError.aspx");
        Context.ClearError();
    }
}

Megavolt

Would DeterminePostBackmode as mentioned here be an alternative solution? [I haven't played with it so I can't tell if it is proper.] – Carma

Answer 2

You don't want to go adding unnecessary baggage to the Global.asax. If you're satisfied that this is caused by spurious data input, then deal with the input, no matter where it's coming from:

http://codersbarn.com/post/2008/11/01/ASPNET-Data-Input-Validation.aspx

Concentrate on the cause of the error :-)

Supine

Thanks for the reply. I'm using regex to handle any input checks, but as a fail-safe, I'd like to have this validation. There may be other exceptions I'd like to handle, this was just one of them to see what the best way to handle them would be. – Toddy

Okay, but with regex you cannot pre-determine the format of malicious input. You need to intercept all input end encode it if necessary :-) – Supine

Ah, of course :D! All the input will be sanitized to remove any special characters at all. The regex is from part of a utility class I made, using some of the expressions from this site: securityfocus.com/infocus/1768 – Toddy

Answer 3

You can use Server.GetLastError() in Application_Error to get the exception that was thrown, inspect the exception, and respond as you like to it (redirect to a page, etc)

Nette