Question

So I’m attempting to submit a string as a param over a Post in Js to an asp.net service and im having some difficulty. Before its stated, I do no have access to the server and can not touch the validation, I am strictly accessing from an external client. I get this response back

System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (message="...t;img src='http://192.168.1...").
    at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection)
    at System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection)
    at System.Web.HttpRequest.get_Form()
    at System.Web.Services.Protocols.HtmlFormParameterReader.Read(HttpRequest request)
    at System.Web.Services.Protocols.HttpServerProtocol.ReadParameters()
    at System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()

The message I’m sending is:

xcvxzcvzxcvxcvzxcv< br /><img src='http://192.168.1.1:82/UserUploads/Images/65968/20130122020024996.jpg' alt='User Image' />

Which I encode using :

htmlEncode: function(str) {
        str = str.replace(/&/g, '&');
        str = str.replace(/'/g, ''');
        str = str.replace(/"/g, """);
        str = str.replace(/</g, '&lt;');
        str = str.replace(/>/g, '&gt;');
        return str;
    },

which produces:

xcvxzcvzxcvxcvzxcv< br /><img src='http://192.168.1.1:82/UserUploads/Images/65968/20130122020802027.jpg' alt='User Image' />

I have run through several validators and checked my encoding and I cannot figure out what is causing the issue. My only guess is that the http:// is causing the problem as its shown in the javascript error, but im not sure. Any help or insight would be greatly appreciated.

Answer 1

The problem was the encoding for ‘. According to user409762, the combination of &# is flagged as dangerous in asp.net.

So now my encoding looks like this and works fine.

htmlEncode: function(str) {
    str = str.replace(/&/g, '&');
    str = str.replace(/"/g, """);
    str = str.replace(/</g, '&lt;');
    str = str.replace(/>/g, '&gt;');
    return str;
},