ValidateRequest="false" ?

[Raterus]

I'm having to set ValidateRequest="false" on one of my pages because users need to enter a value that contains an html tag (well asp.net think it is anyway). I understand why the "potentially dangerous request.form detected" error and why it is being thrown, but my question is:

What could a malicious user possibly do to my application by putting HTML fields within a form field? Is there a vulnerability I should know about in asp.net, or would bad coding on my part really only be the thing I need to worry about if ValidateRequest="false".

Thanks for any insight!
--Michael

 

[Joe Kaplan \(MVP - ADSI\)]

The main issue is Cross Site Scripting. If your site takes input from the
user and then displays it back to the user without first validating it, you
could potentially allow a bad guy to use your site to which is trusted by
your users to steal their cookies or other data.

The built-in request validation stuff in 1.1 tries to keep you from shooting
yourself in the foot by not allowing you to accidentally do this. If you
are careful, it is safe to turn the behavior off, but you need to make sure
you thoroughly validate all input before returning it back to the browser.

HTH,

Joe K.

I'm having to set ValidateRequest="false" on one of my pages because users
need to enter a value that contains an html tag (well asp.net think it is
anyway). I understand why the "potentially dangerous request.form detected"
error and why it is being thrown, but my question is:

What could a malicious user possibly do to my application by putting HTML
fields within a form field? Is there a vulnerability I should know about in
asp.net, or would bad coding on my part really only be the thing I need to
worry about if ValidateRequest="false".

Thanks for any insight!
--Michael

 

[Jos]

I'm having to set ValidateRequest="false" on one of my pages because
users need to enter a value that contains an html tag (well asp.net
think it is anyway). I understand why the "potentially dangerous
request.form detected" error and why it is being thrown, but my
question is:

What could a malicious user possibly do to my application by putting
HTML fields within a form field? Is there a vulnerability I should
know about in asp.net, or would bad coding on my part really only be
the thing I need to worry about if ValidateRequest="false".

Thanks for any insight!
--Michael

Here's a brief article on script attacks:
http://www.asp.net/faq/requestvalidation.aspx