ASP.NET Core 如何覆盖无效值消息

Question

I'm perfoming penetration tests with Acunetix and the following query "api/venues?gameId=1'"()%26%25vAtC(9571)" is getting the following response:

 { "status": 400, "userMessage": [ "There are validation errors" ], "validationErrors": [ "The value '1'\\"()&%<acx><ScRiPt >NJMi(9780)</ScRiPt>' is not valid." ] }

This is detected by Acunetix as a posible XSS security issue and I would like to override the validation error message in order to avoid this in the whole application.

Answer 1

Model binder messages can be customized like this:

services.AddMvcCore().AddMvcOptions(options =>
{
    options.ModelBindingMessageProvider.SetNonPropertyAttemptedValueIsInvalidAccessor(s => "The provided value is invalid.");
});

Answer 2

Its worth adding that there are 3 other baked in binder errors, which display the value back, altogether:

options.ModelBindingMessageProvider.SetAttemptedValueIsInvalidAccessor((x, y) => $"The value is not valid for {y}.");
options.ModelBindingMessageProvider.SetNonPropertyAttemptedValueIsInvalidAccessor(x => "The value is not valid.");
options.ModelBindingMessageProvider.SetValueIsInvalidAccessor(x => "The value is invalid.");
options.ModelBindingMessageProvider.SetValueMustNotBeNullAccessor(x => "The value is invalid.");

Best to check MSDN ModelBinding message providers, for what's currently available.