DataList抛出“潜在危险...".从文本框取消编辑模式 [英] DataList throws "A potentially dangerous..." from textbox on canceling from editmode

问题描述

我实现了一个DataList，其中EditItemTemplate包含一个带有用户输入的文本框.如果不在编辑模式下，则不会显示在文本框中写入的字符串.当字符串包含脚本注入(如警报)时，控件的行为很有趣..不是...

当我单击editmode按钮时，数据列表将按预期显示文本，因为文本框控件可以处理脚本注入.
但是，当我单击取消"编辑模式时，页面转到黄色屏幕，屏幕上出现潜在危险请求.已从客户端检测到表单值"，指向带有脚本注入的文本框.

按下取消按钮时运行的代码:

Hi,
I implemented a DataList where the EditItemTemplate contains a textbox with user input. the string written in the textbox is not showed if not in editmode. When the string contains script injection like alert the control acts funny .... not...

When I click the editmode button the datalist shows the text as expected because the textbox control can handle the script injection.
BUT when I click the cancel editmode the page goes to yellow screen of death with "A potentially dangerous Request. Form value was detected from the client" pointing at the textbox with the script injection.

The code running when cancelbutton is pressed:

MyDataList.EditItemIndex = (int)e.Item.ItemIndex;
MyMessageDataList.DataSource = myList;
MyMessageDataList.DataBind();

有人知道为什么会这样吗?

标签或其他内容中不会显示脚本注入"文本.

Does anyone know why this happen?

The "script injection"-text is not showed in a label or something.

推荐答案

您将不得不在Web中将ValidateRequest设置为false.如果您想抑制这种行为，请配置.但是请注意，这样做会使您的网站容易被脚本注入，因此可能会出现XSS漏洞.您必须自己处理所有用户输入.

You''re going to have to set ValidateRequest to false in web.config if you want to suppress this behaviour. be aware though, that doing this opens your site up to script injection and therefore possible XSS vulnerabilities. you''ll have to handle all the user input yourself.

看来，该错误是按预期工作"的错误.
ValidateRequest似乎可以验证每个文本，并抛出该错误，以防万一...
在我看来，这使validaterequest ="true"在真正不需要这种行为的实际应用程序中无法使用.

it seems that this bug is a "work as intended"-bug.
ValidateRequest seems to validate every text and throws that error just in case...
which seems to me, makes the validaterequest="true" unusable in real applications where that behavior realy itn''t wanted.

这篇关于DataList抛出“潜在危险...".从文本框取消编辑模式的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！