Message: A potentially dangerous Request.Path value was detected from the client (>)

Question

how to resolve this kind of issues? please help me

> 30452  ERROR Application error. Exception: System.Web.HttpException
> Message: A potentially dangerous Request.Path value was detected from
> the client (>).
> 
> Source: System.Web    at
> System.Web.HttpRequest.ValidateInputIfRequiredByConfig()    at
> System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext
> context)

Answer 1

ASP.NET implements various algorithms for securing ASP.NET websites against potentially malicious user requests, for example, by rejecting requests that contain characters susceptible to be used in XSS attacks, suspiciously long request paths, etc.

When potentially malicious requests hit a Sitecore website, they would result in different errors either shown to the website visitor or written to Sitecore log files. You can see the multiple types of scenarios for this.

The error you are getting comes when the requested URL contains invalid characters.

• You need to follow below steps to verify that the links you render on the pages do not contain the invalid characters mentioned in the error message:

  1. For the links rendered using the Sitecore API, ensure that the encodeNameReplacements block in the Web.config file contains the appropriate record:

     <replace mode="on" find="INVALID CHARACTER" replaceWith="REPLACING CHARACTER" />
     

  2. For the links generated by custom code, manually verify that they do not contain these characters and their encoded counterparts.

• In case you do want to use these characters in the path, add the requestPathInvalidCharacters attribute to the httpRuntime node in the Web.config file as follows:

    <httpRuntime ... requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,:,\,?"/>
  

Then exclude particular characters from this list. For more see the Sitecore KB article - https://kb.sitecore.net/articles/031258

Answer 2

The error you are seeing is request validation which is a security mechanism that comes OOTB with ASP.net. These errors can be triggered by multiple scenarios, including:

• Malicious bot traffic (most common)
• User tampering
• Improperly encoded links on your site
• Improperly encoded backlinks on external sites

There are an unbounded amount combinations and permutations of such requests, so it can be tricky to catch all of them. If your site is protected by a WAF (and it should be!), you probably won't see many of these errors, if any. I recommend setting up rules to block these types of requests so that they never reach your application in the first place. You can also implement IP blocking or RECAPTCHA actions when the rules are triggered.

However, it is common for Sitecore site endpoints to not be secured by a WAF, in which case, I recommend blocking the requests with inbound filters in IIS. You could start by slapping down requests for dot files such as .php and .asp which are probably not on your server at all (be sure to check, though). Other good ones are *<script>* and *%3Cscript%3E*.

It is important to set up some broad blocking rules for such requests, as not doing so can lead to interesting second and third order consequences such as:

• Noise in the logs
• Malicious strings showing up in error logging tools that you may use, and worse yet, if the error logging tool does not properly encode the strings, it can cause UI issues or even result in XSS exploits in your third party tools
• Free advertising for hackers when you view their requests in the logs (URLs often contain URLs that advertise gambling, pornography, and phishing sites)

Another option is to ignore such errors entirely (but not to disable the validation).

Final point: there are some legitimate cases in which HTML / special characters in URLs may need to be accepted by your server, so setting up such blocking rules can cause issues. Familiarize yourself with your codebase and any external systems that your site may be integrated with to ensure that you don't break anything.