ASP.NET Request Validation - Revision history

Bill Sempf: Promoted

2014-11-26T16:33:34Z

Promoted

Bricex: /* Don't Rely on Request Validation for XSS Protection */

2014-11-03T21:16:45Z

‎Don't Rely on Request Validation for XSS Protection

Bricex: Adding - Extending Request Validation

2014-11-03T14:56:42Z

Adding - Extending Request Validation

Bricex: /* Selectively Disabling Request Validation */

2014-11-03T14:37:12Z

‎Selectively Disabling Request Validation

Bricex: /* Enabling Request Validation */

2014-11-03T14:36:09Z

‎Enabling Request Validation

Bricex: /* Don't Rely on Request Validation for XSS Protection */

2014-11-03T14:25:42Z

‎Don't Rely on Request Validation for XSS Protection

Bricex at 00:16, 3 November 2014

2014-11-03T00:16:21Z

Bricex: /* Description */

2014-11-02T22:15:50Z

‎Description

Bricex: /* Validating User Input */

2014-10-30T19:23:12Z

‎Validating User Input

Bricex: /* References */

2014-10-30T19:04:51Z

‎References

@@ Line 1: / Line 1: @@
-= DRAFT DOCUMENT - WORK IN PROGRESS =
+=Description=
 ''Request validation'' is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. This exploit is typically referred to as a ''cross-site scripting'' (XSS) attack. Request validation helps to prevent this kind of attack by throwing a "potentially dangerous value was detected" error and halting page processing if it detects input that may be malicious, such as markup or code in the request.
-==Don't Rely on Request Validation for XSS Protection==
+=Don't Rely on Request Validation for XSS Protection=
 Request validation is generally desirable and should be left enabled for [[defense in depth]]. It should '''NOT''' be used as your sole method of XSS protection, and does not guarantee to catch every type of invalid input. There are known, documented bypasses (such as JSON requests) that will not be addressed in future releases, and the request validation feature is no longer provided in ASP.NET vNext.
@@ Line 17: / Line 15: @@
 <pre>var encodedInput = Server.HtmlEncode(userInput);</pre>
-==Enabling Request Validation==
+=Enabling Request Validation=
 Request validation is enabled by default in ASP.NET. You can check to make sure it is enabled by reviewing the following areas:
@@ Line 37: / Line 35: @@
 |}
-==Selectively Disabling Request Validation==
+=Selectively Disabling Request Validation=
 In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible.
-===ASP.NET Web Forms===
+==ASP.NET Web Forms==
 For ASP.NET Web Forms applications prior to v4.5, you will need to disable request validation at the page level. Be aware that when doing this all input values (cookies, query string, form elements) handled by this page will not be validated by ASP.NET.
 <pre><@ Page ValidateRequest="false" %></pre>
@@ Line 47: / Line 45: @@
 <pre><asp:TextBox ID="txtASPNet" ValidateRequestMode="Disabled" runat="server" /></pre>
-===ASP.NET MVC===
+==ASP.NET MVC==
 To disable request validation for a specific MVC controller action, you can use the <code>[ValidateInput(false)]</code> attribute as shown below.
 <pre>[ValidateInput(false)]
@@ Line 64: / Line 62: @@
 }</pre>
-==Extending Request Validation==
+=Extending Request Validation=
 If you are using ASP.NET 4.0 or higher, you have the option of extending or replacing the Request Validation logic by providing your own class that descends from <code>System.Web.Util.RequestValidator</code>. By implementing this class, you can determine when validation occurs and what type of request data to perform validation on.
 <pre>public class CustomRequestValidation : RequestValidator
@@ Line 100: / Line 98: @@
 </system.web>
 </pre>
-==References==
+=References=
 *[http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx Request Validation in ASP.NET]
 *[http://msdn.microsoft.com/en-us/library/debza5t0(v=vs.100).aspx Validation ASP.NET Controls]

@@ Line 13: / Line 13: @@
 * Whitelist of allowed characters
-Any string input that is stored, returned to the client, or interpreted should be encoded using an appropriate method, such as those provided via [[ASP.NET Output Encoding#Enhanced_Encoding|AntiXssEncoder]].
+Any string input that is returned to the client should be encoded using an appropriate method, such as those provided via [[ASP.NET Output Encoding#Enhanced_Encoding|AntiXssEncoder]].
 <pre>var encodedInput = Server.HtmlEncode(userInput);</pre>

@@ Line 64: / Line 64: @@
 }</pre>
 ==References==
 *[http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx Request Validation in ASP.NET]
@@ Line 73: / Line 109: @@
 *[http://msdn.microsoft.com/en-us/library/system.web.mvc.validateinputattribute(v=vs.118).aspx ValidateInputAttribute Class]
 *[http://msdn.microsoft.com/en-us/library/system.web.mvc.allowhtmlattribute(v=vs.118).aspx AllowHtmlAttribute Class]
 *[[ASP.NET Output Encoding]]
 [[Category:OWASP .NET Project]]

@@ Line 38: / Line 38: @@
 ==Selectively Disabling Request Validation==
-In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible and ensure you have implemented field level input validation.
+In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible.
 ===ASP.NET Web Forms===

@@ Line 18: / Line 18: @@
 ==Enabling Request Validation==
-Request validation is enabled by default in ASP.NET. You can check to make sure it is not disabled by reviewing he following areas:
+Request validation is enabled by default in ASP.NET. You can check to make sure it is enabled by reviewing the following areas:
 {| class="wikitable"
-|ASP.NET Web Forms (Global)
+|style="width: 20%;"|ASP.NET Web Forms (Global)
-|Ensure that request validation has not been disabled in web.config: <code><pages validateRequest="false" /></code>
+|Ensure that request validation is set to true (or not set at all) in web.config: <pre><pages validateRequest="true" /></pre>
 |-
 |ASP.NET Web Forms (Page Level)
-|Check to make sure request validation is not disabled at the page level: <code><@ Page ValidateRequest="false" %></code>
+|Check to make sure request validation is set to true (or not set at all) at the page level: <pre><@ Page ValidateRequest="false" %></pre>
 |-
 |ASP.NET 4.0+
-|Starting with ASP.NET 4.0 request validation is performed for all requests, not just for .aspx page requests. To ensure this is configured correctly look to see that it has '''NOT''' been set to 2.0: <code><httpRuntime requestValidationMode="2.0" /></code>
+|Starting with ASP.NET 4.0 request validation is performed for all requests, not just for .aspx page requests. To ensure this is configured correctly requestValidationMode should be set to "4.0" (or not set at all) in web.config: <pre><httpRuntime requestValidationMode="4.0" /></pre>
 |}
 ==Selectively Disabling Request Validation==

@@ Line 5: / Line 5: @@
 ==Don't Rely on Request Validation for XSS Protection==
-Request validation is generally desirable and should be left enabled for [[defense in depth]]. It should '''NOT''' be used as your sole method of XSS protection, and does not guarantee to catch every type of invalid input. There are known, documented bypasses (such as JSON requests) that will not be addressed in future releases, and the request validation feature is no longer supported in ASP.NET vNext.
+Request validation is generally desirable and should be left enabled for [[defense in depth]]. It should '''NOT''' be used as your sole method of XSS protection, and does not guarantee to catch every type of invalid input. There are known, documented bypasses (such as JSON requests) that will not be addressed in future releases, and the request validation feature is no longer provided in ASP.NET vNext.
-Fully protecting your application from malicious input involves validating each field of user supplied data. For Web Forms based applications this will start with [http://msdn.microsoft.com/en-us/library/debza5t0(v=vs.100).aspx ASP.NET Validation Controls]. ASP.NET MVC and Web API based applications should decorate model classes with [http://msdn.microsoft.com/en-us/library/ee256141(VS.100).aspx DataAnnotations attributes]. Any string input that is stored, returned to the client, or interpreted should be encoded using an appropriate method, such as those from [[ASP.NET Output Encoding#Enhanced_Encoding|AntiXssEncoder]].
+Fully protecting your application from malicious input requires validating each field of user supplied data. This should start with [http://msdn.microsoft.com/en-us/library/debza5t0(v=vs.100).aspx ASP.NET Validation Controls] and/or [http://msdn.microsoft.com/en-us/library/ee256141(VS.100).aspx DataAnnotations attributes] to check for:
 <pre>var encodedInput = Server.HtmlEncode(userInput);</pre>

@@ Line 2: / Line 2: @@
 ==Description==
-''Request validation'' is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. ASP.NET performs this check because markup or code in the URL query string, cookies, or posted form values might have been added for malicious purposes. This exploit is typically referred to as a ''cross-site scripting'' (XSS) attack.
+''Request validation'' is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. This exploit is typically referred to as a ''cross-site scripting'' (XSS) attack. Request validation helps to prevent this kind of attack by throwing a "potentially dangerous value was detected" error and halting page processing if it detects input that may be malicious, such as markup or code in the request.
-Request validation helps prevent this kind of attack. If ASP.NET detects any markup or code in a request, it throws a "potentially dangerous value was detected" error and stops page processing. Request validation is generally desirable and should be left enabled unless you have a specific need that would prevent it from being used.
 ==Enabling Request Validation==

@@ Line 29: / Line 29: @@
 Use <code>Server.UrlEncode</code> to encode user input for use in constructing URLs
 <pre>var encodedUrlInput = Server.UrlEncode(userInput);</pre>
 ===Enhanced Request Validation Encoding===

@@ Line 67: / Line 67: @@
 *[http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx Request Validation in ASP.NET]
 *[http://msdn.microsoft.com/en-us/library/System.Web.HttpUtility_methods(v=vs.110).aspx HttpUtility Methods]
 *[http://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder(v=vs.110).aspx AntiXssEncoder Class]
 *[http://www.microsoft.com/en-sg/download/details.aspx?id=43126 Microsoft Anti-Cross Site Scripting Library V4.3]
 *[[ASP.NET Output Encoding]]
 [[Category:OWASP .NET Project]]