"Too many errors occured while downloading files...&quo

cpdaniel · Post by **cpdaniel** » Thu Oct 28, 2004 9:11 am

One other note - the situation discussed in the dotnetjunkies.com posting is precisely what CrossSiteScripting.IsDangerousString was supposed to check. The site correctly describes techniques for disabling the check and for encoding elements to pass through the check.

The case the I encountered with Vault is simply a bug in the cross-site scripting check that runs afoul of a perfectly valid BASE64 string.

Post by **jclausius** » Thu Oct 28, 2004 9:35 am

Carl:

You are correct, when this applies to normal web pages and web applications. I hope my posting doesn't convince anyone to eliminate this check within their normal ASP.Net development.

However, for Vault the file upload/download pages exist only to allow HTTP file transfers. There are no controls on the page, or for that matter anything which would require validation. This would be one of those cases where it would be safe to turn off the validator.

cpdaniel · Post by **cpdaniel** » Thu Oct 28, 2004 10:53 am

Agreed. I'll make that change locally.

Thanks for the help!

cpdaniel · Post by **cpdaniel** » Wed Nov 17, 2004 11:40 am

FYI - I haven't verified it myself, but MSFT claims that this bug is fixed in .NET 2.0.

Post by **jclausius** » Wed Nov 17, 2004 11:55 am

Vault 3.0 will contain the correct page directives to eliminate the problem as well.