"A potentially dangerous Request.Path value was detected from the client" when the URL contains special characters

This article provides information for an error detected in Sitefinity site. When a URL contains any special character such as "<" or ":", an error appears

Apr 13, 2017
Knowledge

Title

URL Name

a-potentially-dangerous-request-path-value-was-detected-from-the-client

Article Number

000183015

Environment

Product: Sitefinity Version: 11.x, 12.x, 13.x, 14.x, 15.x OS: All supported OS versions Database: All supported Microsoft SQL Server versions

Question/Problem Description

When an URL is requested and it contains any special character such as "<" or ":", an error appears looking like the following:

A pontetially dangerous

Steps to Reproduce

1. Start Sitefinity site. 2. Request a URL that contains any special characters like "<" or ":".

Clarifying Information

The error message is occurring because a user typed in a url that is considered unsafe, similar to an attempt to hack the site with URL attack. From the other hand, it may be a mistake by a site user.

Error Message

A potentially dangerous Request.Path value was detected from the client. Exception message: A potentially dangerous Request.Path value was detected from the client (:). at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Defect Number

Enhancement Number

Cause

Because Sitefinity is built with asp.net inherently there is built-in security protection for requesting unsafe URLs. This is ASP.NET security protection, aimed at preventing injection attacks.

Whenever a user types in something that contains a <script> tag e.g. site.com/pages?<script>function execute()</script> the built-in security mechanism in asp.net blocks this request with the message "A potentially dangerous request".

Resolution

Make sure that URLs do not contain any special characters. This includes URLs added in either Kendo or RadEditor using the hyperlink tool.
Usually, the URL that is considered unsafe is not a Sitefinity URL, but a user appended query string on top of the URL so there is no need to take action for this, just remove the query string e.g.

site.com/page?unsage<script>inject()</script>

change the request to have a safe query string without special symbols like '<' :
site.com/page?query=123

Sitefinity content has built-in validation for special symbols in URLs so users can't add such URLs using the user interface, however, code written with Sitefinity API can add them.
In this case, to change the URL and remove special symbols:
- For pages: use Actions -> Title & Properties to edit the URL.
- For content items: click on the content item and edit the URL.

Important note: Sitefinity HTML sanitizer will not strip normal HTML tags.

Workaround

Notes

References to Other Documentation:

w3schools, HTML URL Encoding Reference https://www.w3schools.com/tags/ref_urlencode.asp
StackOverflow, A potentially dangerous Request.Path value was detected from the client (*) https://stackoverflow.com/questions/5967103/a-potentially-dangerous-request-path-value-was-detected-from-the-client

Keyword Phrase

Last Modified Date

11/6/2024 7:38 AM

"A potentially dangerous Request.Path value was detected from the client" when the URL contains special characters

Files(0)

Was this article helpful?

Was this article helpful?

"A potentially dangerous Request.Path value was detected from the client" when the URL contains special characters

Information

Related Articles