由OutputCache过滤器引起的潜在危险请求

Question

我在MVC3应用程序中看到了一个奇怪的行为.我有一个由Ajax调用的Action,并收到一个带有HTML文本的帖子.我想允许输入HTML,所以我设置了ValidateInput(false)属性.我还有一个带有以下参数的全局OutputCache过滤器:(NoStore = true,Duration = 0,VaryByParam ="*")
代码如下所示:

[HttpPost]
[ValidateInput(false)]
[OutputCache(NoStore = true, Duration = 0, VaryByParam = "*" )]
public ActionResult Edit(SomeModel someModel)
{
   saveModel(someModel);
   return new AjaxEditSuccessResult();
}

当我向该方法发送帖子时,它会被执行并保存模型,但我得到的响应是标准的"从客户端检测到一个潜在危险的Request.Form值"错误消息,带有此栈跟踪:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (text="<p class="MsoNormal"...").]
System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +9665149
System.Web.<>c__DisplayClass5.<ValidateHttpValueCollection>b__3(String key, String value) +18
System.Web.HttpValueCollection.EnsureKeyValidated(String key) +9664565
System.Web.HttpValueCollection.Get(String name) +17
System.Web.Caching.OutputCacheModule.CreateOutputCachedItemKey(String path, HttpVerb verb, HttpContext context, CachedVary cachedVary) +676
System.Web.Caching.OutputCacheModule.CreateOutputCachedItemKey(HttpContext context, CachedVary cachedVary) +55
System.Web.Caching.OutputCacheModule.OnLeave(Object source, EventArgs eventArgs) +9716788
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +136
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +69

你知道我是否可以以任何方式指示OutputCache属性它需要尊重ValidateInput属性？

Answer 1

流程中有两个位置可以调用验证:

1. 关于控制器方法的调用
2. 当渲染结果存储在缓存中时.

你已经修复了第一个问题ValidateInputAttribute(false),但看起来像缓存模块忽略了NoStore指令并仍然试图构造缓存键,在此之前它验证参数,摆脱指定:Location = System.Web.UI.OutputCacheLocation.None,以便缓存模块甚至不会尝试做任何事情.用以下内容替换你OutputCache[...]:

[OutputCache(NoStore = true, Location = System.Web.UI.OutputCacheLocation.None)]