0

I hosted an application in ASP.NET 4.0 webforms.

When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:

A potentially dangerous Request.QueryString value was detected from the client (="alert(313)

I am expecting the same error message as above when I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>=1&category=1&code=76, but it loads the page. The only difference is an extra =1 in the latter url.

  • Apparently alert = 1 means continue after displaying alert. Set it to zero if you want it not to continue. – Overmind Apr 11 '18 at 6:53
  • Can you please see it once again, I have edited the question. The script tags are in the url – Hrishikesh T T Apr 11 '18 at 7:19
0

Let's analyze what is happening here by looking at ASP.NET WebForms code.

First example, w/o =1

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22 System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693 System.Web.HttpValueCollection.GetValues(String name) +17 System.Web.UI.Page.DeterminePostBackMode() +99

If we run the code we can see that the exception originates in EnsureKeyValidated but we can get there from GetValues, from DeterminePostBackMode. So if you check there we see this:

      string[] values = nameValueCollection.GetValues((string) null);

so it's look like what we get here is retrieving all the values that are key-less. So the above query could be rewritten to the form null=<script>alert(313)</script>&. So the script is passed to be the value for an null/empty key.

Second example, w/ =1

In here you're making the key to be equal to the script, and the value for that key to be 1. The key's are encoded before they are passed to the server so this would not be an issue.

enter image description here

If you want to replicate the error, you could pass a=<script>alert(313)</script> and you would get the same error just originating from a different place:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.QueryString value was detected from the client (a="alert(1)c__DisplayClass280_0.b__0(String key, String value) +22 System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9904693 System.Web.HttpValueCollection.GetValues(Int32 index) +29 System.Web.HttpValueCollection.ToString(Boolean urlencoded, IDictionary excludeKeys) +206 System.Web.UI.Page.get_ClientQueryString() +411

If you need to you can control what is being denied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.