I’m testing a Tiny_MCE plugin for BlogEngine.NET extension I wrote earlier and I keep receiving the following error message whenever I use my own extension or the extremely popular SyntaxHighlighter extension which both have similar behaviors and both implement Tiny_MCE plugins:
Url :
‘http://localhost/admin/Pages/Add_entry.aspx’Raw Url : /admin/Pages/Add_entry.aspx
Message : A potentially dangerous
Request.Form value was detected from
the client
(ctl00$cphAdmin$txtContent$TinyMCE1$txtContent="Source : System.WebStackTrace : at
System.Web.HttpRequest.ValidateString(String
value, String collectionKey,
RequestValidationSource
requestCollection) at
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection
nvc, RequestValidationSource
requestCollection) at
System.Web.HttpRequest.get_Form() at
System.Web.HttpRequest.get_Item(String
key) at
BlogEngine.Core.Web.HttpModules.CompressionModule.context_PostReleaseRequestState(Object
sender, EventArgs e) in
D:\Projects\Be-1610\BlogEngine\DotNetSlave.BusinessLogic\Web\HttpModules\CompressionModule.cs:line
62 at
System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at
System.Web.HttpApplication.ExecuteStep(IExecutionStep
step, Boolean&
completedSynchronously)TargetSite :
Void ValidateString(System.String,
System.String,
System.Web.Util.RequestValidationSource)
My question is thus: although I receive this error on my local environment (IIS 7.5 ASP.NET 4.0 Integrated App Pool) I receive no error whatsoever on my live environment (IIS 7.5 ASP.NET 3.5 SP1/ 3.0 / 2.0.) Additionally whenever I test the extension using debug mode in Visual Studio 2010 and run the site off of a separate instance I don’t receive this error.
I’m almost certain that the fact that this issue only occurs on my localhost IIS instance indicates that it’s a configuration issue or a behavior specific to ASP.NET 4.0, but I don’t know what exactly. Do any of you know what might be causing this?
The reason you see it as an error now is because of .NET 4.0. This was a breaking change in ASP.NET 4.0 and is described here.
Fastest was to revert is to add this to your web.config:
<httpRuntime requestValidationMode="2.0" />Hope that helps!