2021-06-03 09:05:38 +02:00
|
|
|
=== on 15 Jan 2021, 18:31:49 Andrei Epure wrote:
|
2021-06-02 20:44:38 +02:00
|
|
|
== Sensitive Code Example
|
|
|
|
|
|
|
|
|
|
At application level, configured in the Web.config file:
|
|
|
|
|
|
|
|
|
|
----
|
|
|
|
|
<configuration>
|
|
|
|
|
<system.web>
|
|
|
|
|
<pages validateRequest="false" />
|
|
|
|
|
...
|
|
|
|
|
<httpRuntime requestValidationMode="0.0" />
|
|
|
|
|
</system.web>
|
|
|
|
|
</configuration>
|
|
|
|
|
----
|
|
|
|
|
|
|
|
|
|
== Compliant
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
At application level, configured in the Web.config file:
|
|
|
|
|
|
|
|
|
|
----
|
|
|
|
|
<configuration>
|
|
|
|
|
<system.web>
|
|
|
|
|
<pages validateRequest="true" />
|
|
|
|
|
...
|
|
|
|
|
<!-- see https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.httpruntimesection.requestvalidationmode?view=netframework-4.8 -->
|
|
|
|
|
<httpRuntime requestValidationMode="4.5" />
|
|
|
|
|
</system.web>
|
|
|
|
|
</configuration>
|
|
|
|
|
----
|
|
|
|
|
|
|
|
|
|
include::../comments-and-links.adoc[]
|
