关于表单验证安全的问题

最新推荐文章于 2021-12-04 12:01:24 发布

weixin_33796205

最新推荐文章于 2021-12-04 12:01:24 发布

阅读量191

点赞数

文章标签： python c#

原文链接：https://my.oschina.net/deanzhao/blog/122878

版权

2019独角兽企业重金招聘Python工程师标准>>>

使用FCKeditor后报错：
"从客户端中检测到有潜在危险的 Request.Form 值."
设置了 ValidateRequest="false"后还是报同样错误：

说明: 请求验证过程检测到有潜在危险的客户端输入值，对请求的处理已经中止。该值可能指示存在危及应用程序安全的尝试，如跨站点脚本攻击。若要允许页面重写应用程序请求验证设置，请将 httpRuntime 配置节中的 requestValidationMode 特性设置为 requestValidationMode="2.0"。示例: <httpRuntime requestValidationMode="2.0" />。设置此值后，可通过在 Page 指令或 <pages> 配置节中设置 validateRequest="false" 禁用请求验证。但是，在这种情况下，强烈建议应用程序显式检查所有输入。有关更多信息，请参见 http://go.microsoft.com/fwlink/?LinkId=153133。

英文：

`A potentially dangerous Request.Form value was detected from the client (Text="<p>what?</p>").`

 Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. To allow pages to override application request validation settings, set the requestValidationMode attribute in the httpRuntime configuration section to requestValidationMode="2.0". Example: <httpRuntime requestValidationMode="2.0" />. After setting this value, you can then disable request validation by setting validateRequest="false" in the Page directive or in the <pages> configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case. For more information, see http://go.microsoft.com/fwlink/?LinkId=153133.  Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (Text="<p>what?</p>").

其实是c#的一种表单安全验证机制，建议还是将表单的内容转下码，当然是转成HTML。不转也行，那就找下面两种方法解决吧（二选一）。

1.要先在web.config文件的system.web节设置：<httpRuntime requestValidationMode="2.0"/>

2.在要验证的页面中的配置加上（头部第一行）：validateRequest="false"

转载于:https://my.oschina.net/deanzhao/blog/122878