ASP.NET request validation errors


Description

ASP.NET implements various algorithms for securing ASP.NET websites against potentially malicious user requests, for example, by rejecting requests that contain characters susceptible to be used in XSS attacks, suspiciously long request paths, and so on.

When potentially malicious requests hit a Sitecore website, they might result in different errors either shown to the website visitor or written to Sitecore log files.

In certain situations such request validation might, however, cause normal pages not to load as expected. This article describes different errors caused by ASP.NET request validation and provides information on how to analyze and address them appropriately.

You can read more about the request validation in the MSDN article.

Scenario 1

Error message:

When website visitors submit form values that can be treated as HTML markup, the following error might appear in the log files and might be displayed to users (starting from Sitecore 7.1 Update-2):

ERROR A potentially dangerous Request.Form value was detected from the client (...).
Exception: System.Web.HttpRequestValidationException
Message: A potentially dangerous Request.Form value was detected from the client (...).
Source: System.Web
   at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.get_Form()
   ...

Solution:

Scenario 2

Error message:

When the requested URL contains invalid characters, the following error might appear:

ERROR Application error.
Exception: System.Web.HttpException
Message: A potentially dangerous Request.Path value was detected from the client (&).
Source: System.Web
at System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Solution:

Scenario 3

Error message:

When the length of the requested URL exceeds the predefined value, the following error might appear:

ERROR Application error.
Exception: System.Web.HttpException
Message: The length of the URL for this request exceeds the configured maxUrlLength value.
Source: System.Web
at System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Solution:

Scenario 4

Error message:

When the query string length of the request exceeds the predefined value, the following error might appear:

ERROR Application error.
Exception: System.Web.HttpException
Message: The length of the query string for this request exceeds the configured maxQueryStringLength value.
Source: System.Web
at System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Solution:

Scenario 5

Error message:

When the path of the requested URL does not match the rules for a valid Windows file path, the following error might appear:

ERROR Application error.
Exception: System.Web.HttpException
Message: 
Source: System.Web
at System.Web.CachedPathData.ValidatePath(String physicalPath)
at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Solution: