HtmlEncode on Post for ASP.Net MVC 3 Html.TextAreaFor

Question

I have an ASP.Net MVC 3 page in which I have an Html.TextAreaFor control, see code below. If I try to submit the page to the http post action with text in angle brackets like: <test>, I get a yellow error screen saying:

A potentially dangerous Request.Form value was detected from the client (RequestText="").

I don't understand why I am getting this because I found an article by Scott Guthrie that says the new <%: %> syntax in .Net 4, will automatically HtmlEncode the element. Since I'm using the <%: %> syntax for the Html.TextAreaFor control, I thought it would automatically take care of this and convert the angle brackets to the proper "&lt"; and "&gt" strings.

<% using (Html.BeginForm())
   { %>
    <%: Html.ValidationSummary() %>
    <h2>Enter a description of the support needed</h2>
    <%: Html.TextAreaFor( m => m.RequestText, 4, 90, null) %>
    <input type="submit" value="Submit" />
<% } %>

Answer 1

Basically right now, you're encoding the content of the TextAreaFor on the output. This doesn't help you in the slightest since you're trying to deal with input

If you want to submit "potentially dangerous" content, you need to either

1) decorate the RequestText property within your ViewModel with [AllowHtml]. (preferred)

[AllowHtml]
public string RequestText { get; set; }

2) disable validateRequest

<system.web>
    <compilation debug="true" targetFramework="4.0" />
    <httpRuntime requestValidationMode="2.0" />
</system.web>

Then you must ensure you're appropriately sanitizing that data and/or encoding it in your controller before submitting it to your Repository Layer or Database.

Answer 2

You could decorate your RequestText property on the view model with the AllowHtmlAttribute:

[AllowHtml]
public string RequestText { get; set; }

This way you are authorizing the client to submit HTML for this property only.

As far as the <%: %> syntax is concerned, this is used to HTML encode some value before outputting it to the page. It is used to protect against XSS attacks. It is irrelevant in your case because you are not outputting to the page, you are receiving HTML characters in a request.