使用敲除将HTML字符串传递给C＃控制器。 我究竟做错了什么？

Question

Alright. I can get the HTML I need from the page (it's all in a DIV). That's not the problem. What I need to do is take the HTML and pass it, via a C# class into a controller.

I tried doing something like this with knockout/jQuery:

    var Details = $("#Details").html();
    console.log(Details);

    DetailsPdf.DetailsMarkup = JSON.stringify(Details);

    var jsonData = ko.toJS(Details);

    ko.utils.postJson("/MyController/MyAction", DetailsPdf);

The knockout actually DOES get me the relevant HTML. But when I pass it to my class, I get an exception that reads:

A potentially dangerous Request.Form value was detected from the client.

Then it partially shows the HTML I was sending as a part of the exception. I can't even seem to pass in the entities themselves without getting that exception.

This is an app with certain company-mandated security features, so turning off validation is not an option.

I need the HTML, or at least a way to re-create it on the server in the C#.

I'm still fairly new to knockout. Does anyone have any suggestions here?

Answer 1

You should be able to decorate your model (the one that the controller action is expecting) with the [AllowHtml] attribute on the property that has the HTML.

When you do that, MVC skips the validation for that property.

Here's a link to the documentation for more information.

Note Use this ONLY when you need to. It does open a vector for XSS if misused.

---

Edit: If for some reason, You can't use the [AllowHtml] attribute, you can turn off validating the request for that one action with [ValidateInput(false)] .

Same rules apply. Use that very sparingly. This means none of security validations will run against that particular model in that particular action only.

Answer 2

You should have mentioned that:

This is an app with certain company-mandated security features, so turning off validation is not an option.

In your recent question Using iTextSharp with the knockout JavaScript framework? . I could have provided this answer there.

I'm not sure why decorating the controllers Action with [ValidateInput(false)] isn't working, but that answer's fully working source code is available . Whatever the reason, you should only need a few changes to workaround the issue:

(1) Base64 encode the HTML in your JavaScript:

ko.utils.postJson("/MyController/MyAction", window.btoa(DetailsPdf));

(2) Decode string in your MVC Controller:

[HttpPost]
public ActionResult Index(string xHtml)
{
    xHtml = Encoding.UTF8.GetString(Convert.FromBase64String(xHtml));

(3) Deserialize that string to your model / entities with Json.Net or other.

Above steps have also been tested and verified working. ;)