Consider adding RequestValidator.Current.InvokeIsValidRequestString

[g2petter]

I'm trying to migrate a solution to .NET Standard 2.0 using the System.Web adapaters, and it's been working well until I came across a project where we use the System.Web.Util namespace, specifically the RequestValidator.

using System.Web.Util results in "The type or namespace name "Util" does not exist [...]"

Does this mean that the Util namespace isn't supported by this project? If so, are there any plans to add support for it later?

[adityamandaleeka]

@g2petter Can you share more about what you're using the RequestValidator for?

@blowdart @GrabYourPitchforks Do you have any guidance on whether/how to approach replacing RequestValidator usage with something from the Core world?

[blowdart]

It would be replaced with a custom middleware in which you'd inspect and validate the properties you want to validate. Validating body elements would be difficult though, as you'd have to buffer, read the body, and then get asp.net to parse it for things like form elements. I'm not sure if you can plug into the pipeline at a point after the request has been parsed but before routing happens, @Tratcher may have some ideas.

[Tratcher]

Middleware can easily read the request path, query, headers, and even small-medium forms. Validating request body content in any other format would require buffering and duplicate parsing.

[g2petter]

@adityamandaleeka, we're using the RequestValidator.Current.InvokeIsValidRequestString method to check if certain strings contain potential XSS attacks.

[Tratcher]

Inspecting the input content is not a robust safety measure. A better approach is to ensure that all output values are properly encoded.

[g2petter]

We are also doing that. This is intended as an additional safety measure and to provide the submitting user with immediate feedback that the data isn't valid.

In the process of updating another solution to .NET Standard 2.0 I have also found that the HttpContext.Current.ApplicationInstance isn't available in the adapters. Will this be added? Is it preferred that I open a separate issue asking about that?

[twsouthwick]

@g2petter Did you see the new issue created #273 about Applicationinstance? We'd like to understand your use case there.