In some scenario, we need to send HTML value/content as input to our applicationย from the view to the controller. In some time we use HTML Editors to save the HTML content if the end user accept. By default, ASP.NET MVC framework prevents you from submittingย the HTML content/potentially malicious content to the controller,ย for avoiding the cross site scripting attack.ย This feature is called request validation.

Used Version Detail :ย Visual studio 2013, Version 4.5, MVC 5

Controller:

This is the simple ValideInput controller and it will render the view as output. And in the form submission, it will redirect to GetDescription() action and bind the view.ย In default, ValidateInput attribute parameter is true (ValidateInput(true)).

View:

Here it is the view forย getting the form data from the user, which contain one textbox and submit button insideย the BeginForm. After user submission it will redirect to the GetDescription action method inside the dotnethelpers controller.

Output :

As per below screen, we are entering a content with HTML elements. And once we click on the submit button, then it will throw the error as like below because, inย default ASP.NET MVC prevents the HTML element as form data. In simple, ASP.NET MVC cannot send HTML values to the controller.

ValideInput validation in MVC

ValideInput validation potentially dangerous in MVC

Note:

This is not an issue, it is default security validation handling by the ASP.NET MVC. In some scenario we need to override this ย security by using the ValidateInput attribute to prevent HTML explicitly.

Implementing ValidateInput attribute:

In default, ValidateInput parameter is true (ValidateInput(true).

GetDescription View:

Run the application and apply the Html element as input (Ex : http://localhost:62536/dotnethelpers/ValideInput).
Now its redirect to the “GetDescription View” instead of throwing the potential error as shown below.

ValideInput Attribute in MVC

 

Make Note Before Use:

  • XSS (Cross site scripting) is a security attack where this can inject malicious code while input the entry.
  • In ASP.NET MVC, it prevented the above attract by default.
  • ValidateInput attribute is unsafe because it still allows others to inject malicious code.
  • It can be applied on theย controller/action level, but not for modelย property.
  • Model level can beย handle by usingย [AllowHtml] attribute
  • public classย UserDetails
    {
    [AllowHtml]
    public string userDescription { get; set; }
    }

 

Happy codding !!!