This rule is deprecated; use S5753 instead.
Why is this an issue?
ASP.Net has a feature to validate HTTP requests to prevent potentially dangerous content to perform a cross-site scripting (XSS) attack. There is
no reason to disable this mechanism even if other checks to prevent XXS attacks are in place.
This rule raises an issue if a method with parameters is marked with System.Web.Mvc.HttpPostAttribute and not
System.Web.Mvc.ValidateInputAttribute(true).
Noncompliant code example
public class FooBarController : Controller
{
[HttpPost] // Noncompliant
[ValidateInput(false)]
public ActionResult Purchase(string input)
{
return Foo(input);
}
[HttpPost] // Noncompliant
public ActionResult PurchaseSomethingElse(string input)
{
return Foo(input);
}
}
Compliant solution
public class FooBarController : Controller
{
[HttpPost]
[ValidateInput(true)] // Compliant
public ActionResult Purchase(string input)
{
return Foo(input);
}
}
Exceptions
Parameterless methods marked with System.Web.Mvc.HttpPostAttribute will not trigger this issue.
Resources
