Nugetgallery: Contact forms do not support "<" and ">" in message and throw a cryptic error

[yevgen-nykytenko]

Hi,
"Contact Us" form doesn't work (https://www.nuget.org/policies/Contact). I see "Sorry, an error occurred while processing your request.
Error: Oh no, we broke something!" message after a click on "Contact" button.

[scottbommarito]

Hello,

I was able to successfully send a support request using Contact Us page. Did you put anything unusual in your message/title, for example characters not in the English language, or was your message/title extremely long?

I would suggest trying to send your message again, and if it fails, feel free to send the message to [email protected] directly (but include your account name).

[yevgen-nykytenko]

Hi, I was able to send after removing ">", "<" signs from message body. Thank you for quick response and helpful suggestions.

[robertmuehsig]

@scottbommarito My guess: Because of the ASP.NET Request Validation all requests that contain < > will receive such an error. [AllowHtml] should fix it (like it did here https://github.com/NuGet/NuGetGallery/pull/3388)

Maybe someone should check the following forms if < > are possible:

• Contact NuGet Support
• Contact Owner (Already done - Message has AllowHtml and is HtmlEscaped when send)
• Add Owner with Message (Already done - Message set via json and is HtmlEscaped when send)
• Report Abuse (Already done - Message has AllowHtml and is HtmlEscaped when send)

At least these are the forms where I would think it is safe to insert < >

It this something for an up-for-grabs issue?

[scottbommarito]

@robertmuehsig That sounds precisely like the issue!

I'm going to reopen this issue, rename it, and mark it as up-for-grabs.

[mgroves]

Yep, AllowHtml seems to have done the trick.