2

I am using Json to send update information to the following controller action:

    [HttpPost]
    public JsonResult JsonUpdate(string pk, string rk, string fld, string val) {
        Content content = null;
        try {
            if (fld == "TempRowKey") {
                content = contentService.Get(pk, rk);
                rk = utilityService.DotFormatToRowKey(val);
                contentService.UpdateRowKey(content, rk, User.Identity.Name);
            } else {

I realize it's an added protection in MVC that's causing the problem but I need to be able to pass HTML code in the val argument and I am getting the following error:

A potentially dangerous Request.Form value was detected from the client (val="...e HashMap <K,V>, LinkedHashMap...").

Note that the is valid text that an admin person entered. This screen is only used by admins and so I am okay with no protection for the field.

Looks like there were some changes between MVC2, 3 and 4.

What are the ways I can avoid this problem with MVC3 and MVC4. I saw there's another post like mine on stackoverflow but it does not really address the problem.

Note I am looking for something local that I can apply to just this action. I saw some suggestions on the web but it looks like there's confusion between how to handle this with the different MVC versions. Is the best way to encode and decode the data and if so how could I do that?

4

2 回答 2

3 
[ValidateInput(false)]
public JsonResult JsonUpdate(string pk, string rk, string fld, string val)
{
    ...

但是，您也应该能够执行以下操作：

public class MyJsonUpdateModel
{
    public string pk { get; set; }
    public string rk { get; set; }
    public string fld { get; set; }

    [AllowHtml]
    public string val { get; set; }
}

// [ValidateInput(false)] not needed because model states HTML is allowed
public JsonResult JsonUpdate(MyJsonUpdateModel model)
{
于 2012-08-04T11:37:17.177 回答
0 
public class MyModel{
  [AllowHtml]
  public string  Text{get;set;}
}

您需要将 [AllowHtml] 属性添加到该字段。还要确保你没有向 Action 添加 FormCollection 模型，你可以看到 https://stackoverflow.com/a/4866070/1431191

于 2012-12-24T23:12:39.430 回答