ASP.NET MVC - A potentially dangerous Request.Form value was detected from the client

Question

Am trying to click save button to update what I have in text editor using ckeditor but I got this error A potentially dangerous Request.Form value was detected from the client (OPTION_VALUE="

Welcome to the Na...").

The controller is shown below

Controller

        public ActionResult EditRegistrationGuideline(long id)
    {
        OPTIONS options = _optionsService.GetOption(id);
        return View(options);
    }

    //
    // POST: /Product/Edit/5

    [HttpPost]
    public ActionResult EditRegistrationGuideline(long id, OPTIONS options)
    {
        try
        {
            // TODO: Add update logic here
            if (ModelState.IsValid)
            {
                options.OPTION_ID = id;
                options.ACTION_STATUS = 0;
                options.CREATED_DATE = DateTime.Now;
                _optionsService.AddOption(options);
                return RedirectToAction("Index");
            }
        }
        catch
        {
            //return View();
            ModelState.AddModelError("", "We cannot edit this Option. Verify your data entries !");
        }

        return View();
    }

and the view is here

View

@{

//ViewBag.Title = "CreateRegistrationGuideline";

  }


   
      Edit Registration Guideline

  
   @using (Html.BeginForm("EditRegistrationGuideline", "Options", FormMethod.Post, new { @class = "form-horizontal", @enctype = "multipart/form-data" }))
   {
    @Html.AntiForgeryToken()

    
        @*OPTIONS
            *@
        @*@Html.ValidationSummary(true)*@
        @Html.ValidationSummary(false, null, new { @class = "text-danger" })
        
            
                
                    
                        Edit Option
                    
                    
                        @*

                            @Html.LabelFor(model => model.OPTION_NAME, new { @class = "control-label col-md-2" })
                            *@

                        @*@Html.LabelFor(model => model.OPTION_NAME, new { @class = "control-label col-md-2" })
                            *@

                        @*@Html.EditorFor(model => model.OPTION_NAME)*@
                        @*@Html.HiddenFor(model => model.faculty_activation_date, new { @Value = System.DateTime.Now })*@
                        @Html.HiddenFor(model => model.OPTION_NAME)
                        @Html.ValidationMessageFor(model => model.OPTION_NAME)



                        
                            @*@Html.LabelFor(model => model.OPTION_VALUE, new { @class = "control-label col-md-2" })*@
                            
                                @Html.LabelFor(model => model.OPTION_VALUE, "Option Value")
                                @**@
                                @Html.TextAreaFor(model => model.OPTION_VALUE, new { @class = "form-control", @id = "editor1" })
                                @Html.ValidationMessageFor(model => model.OPTION_VALUE, "", new { @class = "text-danger" })
                            
                        

                        @*

                                @Html.LabelFor(model => model.OPTION_VALUE, "Option Value")
                                @Html.TextAreaFor(model => model.OPTION_VALUE, new { @type = "textarea", @id="editor1", @class = "form-control", @placeholder = "Enter Option Value", @autocomplete = "on" })
                                @Html.ValidationMessageFor(model => model.OPTION_VALUE, null, new { @class = "text-danger" })
                            *@

                        @*
                                @Html.LabelFor(model => model.ACTION_STATUS, new { @class = "control-label col-md-2" })
                                
                                    @Html.EditorFor(model => model.ACTION_STATUS)
                                    @Html.ValidationMessageFor(model => model.ACTION_STATUS)
                                
                            *@

                    

                    
                        
                            
                                
                            
                        
                    
                

            
        
    

}

@*
        @Html.ActionLink("Back to List", "Index")
    *@

@section Scripts {
@Scripts.Render("~/bundles/jqueryval")





}

Please what do I do.

I use CKEDITOR

user_8127001 · Answer

XSS error ("A potentially dangerous Request.Form value was detected from the client(...)"). Solution:

[ValidateInput(false)]

Differnce b/w them

AllowHtml:

The AllowHtml attribute can be applied to a Model property and it will disable the validation by ASP.Net MVC only for that particular property

Advantages The AllowHtml attribute is developed for Model class. The Scope is limited to specific property of the Model class. It is the safe and recommended solution.

ValidateInput

The ValidateInput attribute can be applied to a Controller’s Action method and it will disable the validation by ASP.Net MVC only for that particular Action method.

Advantages

The Scope is limited to specific Action method of the Controller class. If you have multiple properties accepting HTML content, then this method will reduce redundancy. When Model class is not used for designing Form elements then this attribute is needed.For complete details Link

user_1433093 · Answer

Just place ValidateInput(false) attribute on controller's action.

[HttpPost]
[ValidateInput(false)]
public ActionResult EditRegistrationGuideline(long id, OPTIONS options)

The other option is to place [AllowHtml] attribute on Model Property, have a look on SO post to get difference between them

ValidateInput(false) vs AllowHtml

user_10886693 · Answer

I was experiencing a similar issue with the following error message A potentially dangerous Request.Form value was detected from the client.

As an alternative to the previous answers, I found encoding the value passed back to the controller worked. CKEditor allows you to do this by setting the config config.htmlEncodeOutput = true;.

The documentation for this can be found at: https://docs-old.ckeditor.com/ckeditor_api/symbols/CKEDITOR.config.html#.htmlEncodeOutput

user_11141624 · Answer

I got this error while testing XSS on my site. This is a very good feature that the model gives us that prevents XSS, CSRF from penetrating your site. Do not disable it as much as possible.

ASP.NET MVC - A potentially dangerous Request.Form value was detected from the client

4 Answers