Disabled request validation (ARCH335)

Key dotnet.security.disabled-request-validation · Severity warning · Category security · CWE CWE-79

Using [ValidateInput(false)] disables built-in request validation and allows potentially dangerous HTML/script content to be processed. This can lead to cross-site scripting (XSS) attacks.

Incorrect

[HttpPost]
[ValidateInput(false)]
public ActionResult SaveComment(string body)
{
    _comments.Save(body);
    return RedirectToAction("Index");
}

Correct

[HttpPost]
public ActionResult SaveComment(string body)
{
    var sanitized = _sanitizer.Sanitize(body);
    _comments.Save(sanitized);
    return RedirectToAction("Index");
}

Fix

Avoid [ValidateInput(false)]; if rich content is required, clean input with a trusted HTML sanitizer and encode output.