Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Oddly enough, the day after I attempted to answer this, a co-worked asked me to help with the same problem, so here's what I'm up to so far...</p> <p>(Bare in mind that while I've been developing in .Net for a number of years, I've never had need to delve that deeply into the page life cycle, ViewState or any of the hideously complicated bits that keep better dev's up at night)</p> <p>Initially, I thought that overriding the PostBack event in JavaScript would allow me to edit the form post and remove the offending characters, so I tried it with a simple alert, but the <em>potentially dangerous Request.Form</em> was still appearing, so whatever's causing it is happening before the PostBack event is being fired.</p> <p>So, after investigating the <a href="http://msdn.microsoft.com/en-us/library/ms178472.aspx" rel="nofollow">page life cycle</a>, overriding every method I could and doing a whole lot of debugging, I found that the error is being throw in the DeterminePostBackMode method.</p> <p>Now, by my understanding, this method looks at the form post and converts it to a NameValueCollection, so I built my own NameValueCollection, stripping out the "&lt;" character (I only tested with that character to start with).</p> <pre><code>Protected Overrides Function DeterminePostBackMode() As System.Collections.Specialized.NameValueCollection Dim stream As New System.IO.StreamReader(Request.InputStream) Dim nvCollection As New System.Collections.Specialized.NameValueCollection() Dim _split() As String = stream.ReadToEnd().Split("&amp;") If _split.Length &gt; 1 Then For i As Integer = 0 To _split.Length - 1 Dim kv() As String = _split(i).Split("=") Dim _key As String = HttpUtility.UrlDecode(kv(0)) Dim _value As String = HttpUtility.UrlDecode(kv(1)) If _value.Contains("&lt;") Then _value = "" nvCollection.Add(_key, _value) Next End If 'For Each s As String In nvCollection ' Response.Write(String.Format("&lt;p&gt;{0}={1}&lt;/p&gt;", s, nvCollection(s))) 'Next Return nvCollection End Function </code></pre> <p>And that worked brilliantly, the offending value was being stripped out and the NameValueCollection was being returned without causing an error...</p> <p>Except I was still seeing the error message.</p> <p>At the moment, I've tracked it to the PreInit page event, and I'm trying to figure a way around it, I'll update this as I make progress.</p> <p>UPDATE:</p> <p>I'm now fairly sure that the issue ISN'T with the values being stored in the ViewState. After reading <a href="http://weblogs.asp.net/infinitiesloop/archive/2006/08/03/Truly-Understanding-Viewstate.aspx" rel="nofollow">this</a> excellent article on ViewState, I tried setting the value of a TextBox to <code>"&lt;script"</code> declaratively, which means it shouldn't be stored in the ViewState, which means that the error isn't caused by processing being carried out on the ViewState.</p> <p>I think.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload