提出“潜在危险的Request.Form值”的条件是否是？错误取决于 .NET 配置和版本？
我正在测试我之前编写的 BlogEngine.NET 扩展的 Tiny_MCE 插件，但我不断收到以下错误消息每当我使用自己的扩展或非常流行的 SyntaxHighlighter 扩展时，它们都有相似的行为并且都实现 Tiny_MCE 插件：
网址： 'http://localhost/admin/Pages/Add_entry.aspx'
原始网址：/admin/Pages/Add_entry.aspx
消息：潜在危险 Request.Form 值检测自 客户 (ctl00$cphAdmin$txtContent$TinyMCE1$txtContent="
来源：System.WebStackTrace：位于 System.Web.HttpRequest.ValidateString(字符串 值，字符串集合Key， 请求验证源 请求集合）在 System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc、请求验证源 请求集合）在 System.Web.HttpRequest.get_Form() 位于 System.Web.HttpRequest.get_Item(字符串 键）在 BlogEngine.Core.Web.HttpModules.CompressionModule.context_PostReleaseRequestState（对象 发送者、EventArgs e) 中 D：\ Projects \ Be-1610 \ BlogEngine \ DotNetSlave.BusinessLogic \ Web \ HttpModules \ CompressionModule.cs：行 62 于 System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() 在 System.Web.HttpApplication.ExecuteStep（IExecutionStep 步骤，布尔值& 同步完成）TargetSite ： 无效 ValidateString(System.String, 系统.字符串, System.Web.Util.RequestValidationSource）
我的问题是：虽然我在本地环境（IIS 7.5 ASP.NET 4.0 Integrated App Pool）上收到此错误，但我在实时环境（IIS 7.5 ASP.NET 3.5 SP1）上没有收到任何错误/ 3.0 / 2.0。）此外，每当我在 Visual Studio 2010 中使用调试模式测试扩展并在单独的实例中运行该站点时，我都不会收到此错误。
我几乎可以肯定，此问题仅发生在我的本地主机 IIS 实例上这一事实表明这是一个配置问题或特定于 ASP.NET 4.0 的行为，但我不知道到底是什么。你们中有人知道这可能是什么原因造成的吗？
I'm testing a Tiny_MCE plugin for BlogEngine.NET extension I wrote earlier and I keep receiving the following error message whenever I use my own extension or the extremely popular SyntaxHighlighter extension which both have similar behaviors and both implement Tiny_MCE plugins:
Url :
'http://localhost/admin/Pages/Add_entry.aspx'Raw Url : /admin/Pages/Add_entry.aspx
Message : A potentially dangerous
Request.Form value was detected from
the client
(ctl00$cphAdmin$txtContent$TinyMCE1$txtContent="Source : System.WebStackTrace : at
System.Web.HttpRequest.ValidateString(String
value, String collectionKey,
RequestValidationSource
requestCollection) at
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection
nvc, RequestValidationSource
requestCollection) at
System.Web.HttpRequest.get_Form() at
System.Web.HttpRequest.get_Item(String
key) at
BlogEngine.Core.Web.HttpModules.CompressionModule.context_PostReleaseRequestState(Object
sender, EventArgs e) in
D:\Projects\Be-1610\BlogEngine\DotNetSlave.BusinessLogic\Web\HttpModules\CompressionModule.cs:line
62 at
System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at
System.Web.HttpApplication.ExecuteStep(IExecutionStep
step, Boolean&
completedSynchronously)TargetSite :
Void ValidateString(System.String,
System.String,
System.Web.Util.RequestValidationSource)
My question is thus: although I receive this error on my local environment (IIS 7.5 ASP.NET 4.0 Integrated App Pool) I receive no error whatsoever on my live environment (IIS 7.5 ASP.NET 3.5 SP1/ 3.0 / 2.0.) Additionally whenever I test the extension using debug mode in Visual Studio 2010 and run the site off of a separate instance I don't receive this error.
I'm almost certain that the fact that this issue only occurs on my localhost IIS instance indicates that it's a configuration issue or a behavior specific to ASP.NET 4.0, but I don't know what exactly. Do any of you know what might be causing this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您现在将其视为错误的原因是 .NET 4.0。这是 ASP.NET 4.0 中的一项重大更改，此处进行了描述。
最快的恢复方法是将其添加到您的 web.config 中：
希望有帮助！
The reason you see it as an error now is because of .NET 4.0. This was a breaking change in ASP.NET 4.0 and is described here.
Fastest was to revert is to add this to your web.config:
<httpRuntime requestValidationMode="2.0" />Hope that helps!
它告诉您某个控件（例如文本输入）正在返回类似于 HTML 或 javascript 的内容，并且它不会假设您正在清理输入。
当然，由于您对自己的输入感到偏执（您是，不是吗？），您可以关闭该警告。
如何为该页面关闭它：
要为整个站点关闭它，请将其放入 web.config 中：
It's telling you that a control (such as a text input) is returning something that looks like HTML or javascript, and that it's not going to assume you're sanitizing your inputs.
Of course, since you are being paranoid about your inputs (you are, aren't you?) you can turn that warning off.
How to turn it off for that page:
To turn it off for the whole site, put this in web.config:
我相信 TinyMCE 有一种方法对其提交到服务器的内容进行编码。检查一下，这条消息就会消失。因为@egrunin说的是正确的。
TinyMCE I believe has a way to encode the content that it submits to the server. Check that out and this message will go away. Because what @egrunin said is correct.
这基本上是因为，用户可能已经以 html 标签形式发布了一些数据，或者 tiny-mce 正在以 html 形式发布数据。尝试查找将从编辑器返回纯文本的属性。如果以上方法能解决您的问题，您也可以尝试一下。
It is basically because , user might have posted some data in html tag form or tiny-mce is posting data in html forms. Try looking for properties that will return plain text from the editor. Also you can try above if it solves your issue.