Potentially dangerous request loads the page

Question

I hosted an application in ASP.NET 4.0 webforms.

When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:

A potentially dangerous Request.QueryString value was detected from the client (="alert(313)

I am expecting the same error message as above when I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>=1&category=1&code=76, but it loads the page. The only difference is an extra =1 in the latter url.

Answer 1

Let's analyze what is happening here by looking at ASP.NET WebForms code.

First example, w/o =1

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22 System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693 System.Web.HttpValueCollection.GetValues(String name) +17 System.Web.UI.Page.DeterminePostBackMode() +99

If we run the code we can see that the exception originates in EnsureKeyValidated but we can get there from GetValues, from DeterminePostBackMode. So if you check there we see this:

      string[] values = nameValueCollection.GetValues((string) null);

so it's look like what we get here is retrieving all the values that are key-less. So the above query could be rewritten to the form null=<script>alert(313)</script>&. So the script is passed to be the value for an null/empty key.

Second example, w/ =1

In here you're making the key to be equal to the script, and the value for that key to be 1. The key's are encoded before they are passed to the server so this would not be an issue.

If you want to replicate the error, you could pass a=<script>alert(313)</script> and you would get the same error just originating from a different place:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (a="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22 System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693 System.Web.HttpValueCollection.GetValues(Int32 index) +29 System.Web.HttpValueCollection.ToString(Boolean urlencoded, IDictionary excludeKeys) +206 System.Web.UI.Page.get_ClientQueryString() +411

If you need to you can control what is being denied.