ASP.NET implements various algorithms for securing ASP.NET websites against potentially malicious user requests, for example, by rejecting requests that contain characters susceptible to be used in XSS attacks, suspiciously long request paths, and so on.
When potentially malicious requests hit a Sitecore website, they might result in different errors either shown to the website visitor or written to Sitecore log files.
In certain situations such request validation might, however, cause normal pages not to load as expected. This article describes different errors caused by ASP.NET request validation and provides information on how to analyze and address them appropriately.
You can read more about the request validation in the MSDN article.
Error message:
When website visitors submit form values that can be treated as HTML markup, the following error might appear in the log files and might be displayed to users (starting from Sitecore 7.1 Update-2):
ERROR A potentially dangerous Request.Form value was detected from the client (...). Exception: System.Web.HttpRequestValidationException Message: A potentially dangerous Request.Form value was detected from the client (...). Source: System.Web at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) at System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) at System.Web.HttpRequest.get_Form() ...
Solution:
<httpRuntime ... requestValidationMode="2.0"/>
<page ... validateRequest="false"/>
<%@ Page ... ValidateRequest="true" %>
Error message:
When the requested URL contains invalid characters, the following error might appear:
ERROR Application error. Exception: System.Web.HttpException Message: A potentially dangerous Request.Path value was detected from the client (&). Source: System.Web at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Solution:
<httpRuntime ... requestPathInvalidCharacters="<,>,*,%,&,:,\,?"/>Then exclude particular characters from this list.
Error message:
When the length of the requested URL exceeds the predefined value, the following error might appear:
ERROR Application error. Exception: System.Web.HttpException Message: The length of the URL for this request exceeds the configured maxUrlLength value. Source: System.Web at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Solution:
Error message:
When the query string length of the request exceeds the predefined value, the following error might appear:
ERROR Application error. Exception: System.Web.HttpException Message: The length of the query string for this request exceeds the configured maxQueryStringLength value. Source: System.Web at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Solution:
Error message:
When the path of the requested URL does not match the rules for a valid Windows file path, the following error might appear:
ERROR Application error. Exception: System.Web.HttpException Message: Source: System.Web at System.Web.CachedPathData.ValidatePath(String physicalPath) at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Solution: