Exception message: A potentially dangerous Request.Form value was detected from the client

A recent requirement was to transfer XML documents via HTTP Post on the dotNET 2.0 platform. I had set up the “application” to receive the XML stream and save the data as a file (Sample codes demonstrates reading location from config and saving the stream; content validation not shown).
protected void Page_Load(object sender, EventArgs e)
        {
            using (System.IO.StreamReader reader = new System.IO.StreamReader(Request.InputStream))
            {
                String xmldata = reader.ReadToEnd();
                Response.ContentType = "text/xml";
                //Response.Write(xmldata);
                Response.Write(String.Format("Bytes received: {0}", xmldata.Length));

                string myConfigValue = WebConfigurationManager.AppSettings["DropOffFolder"];
                if (System.IO.Directory.Exists(myConfigValue))
                {
                    Guid g = new Guid();
                    g = Guid.NewGuid();
                    string filename = myConfigValue + g.ToString() + ".xml";
                    //Response.Write(filename);
                    using (StreamWriter sw = new StreamWriter(filename))
                    { sw.Write(xmldata); }
                }

                Response.ContentEncoding = System.Text.Encoding.UTF8;
                Response.Flush();
                Response.End();
                Response.Close();
            }
        }
 
During testing I had sent successfully exchanged text data. However, when I tried to send XML data I received a 500 response error from the server, which is very generic.  I reviewed the event log on the server to see if IIS logged any messages and noticed the following warning:
Exception information:
    Exception type: HttpRequestValidationException
    Exception message: A potentially dangerous Request.Form value was detected from the client.

 

The server was validating the data stream, which is uuencoded HTML. To bypass this particular validation I added  ValidateRequest="false to the page directive. The ValidateRequest attribute checks for potentially dangerous input data that could compromise the security of your application or a scripting attack.

 

Note:  When ValidateRequest is disabled, content can be submitted to your application; it is the responsibility of the application developer to ensure that content is properly encoded or processed.

Another way to process the data, without having to disable validation, would be to encode and decode it using Server.HtmlEncode(string) and Server.HtmlDecode(string).



   

Microsoft Dynamics Nav: Web Services User Credentials

In previous posts (Adding a Record through Web Services, Retrieving a set of Records through Web Services, Using an XMLPort as a .NET DataSource) I demonstrated a simple solution for connecting to a Microsoft Dynamics Nav Web Service. In each of the examples the default user credentials were used. To connect to a Microsoft Dynamics Nav Web Service with specified user credentials you use the System.Net.NetworkCredential:
 
            ws = new GetSetCustomers_Binding();
            
            //ws.UseDefaultCredentials = true;
            System.Net.NetworkCredential cred = new System.Net.NetworkCredential("username","password","domain");
            ws.UseDefaultCredentials = false;
            ws.Credentials = cred;
 



   

C#: Populate a ComboBox with Enum Values

A C# example for populating a ComboBox with the values of an Enum.

The Enum:

public enum FromAccount
    { checking = 0, savings = 1, foodstamps = 2, cashbenefit = 3 }

The Code:

comboBox1.DataSource = Enum.GetValues(typeof(FromAccount));
comboBox1.SelectedIndex = 0;



   

C#: Decode Base64 Encoded String

C# code to dencode a Base64 encoded string to its equivalent string representation.

private string DecodeBase64(string s)
        {
            try
            {
                byte[] ascBytes = System.Convert.FromBase64String(s);
                return System.Text.ASCIIEncoding.ASCII.GetString(ascBytes);
            }
            catch (Exception e) { throw new Exception(e.Message); }
        }



   

C#: Base64 Encode a String

C# code to encode a string to its equivalent string representation that is encoded with base-64 digits.
private string EncodeBase64(string s)
        {
            try
            {
                byte[] ascBytes = System.Text.ASCIIEncoding.ASCII.GetBytes(s);
                return System.Convert.ToBase64String(ascBytes);
            }
            catch (Exception e) { throw new Exception(e.Message); }
        }