[validateinput(false)] not working by TonyBolding

Hi,

The request validation feature in ASP.NET has changed from v3.5 to v4. In ASP.NET 4 request validation runs much earlier in the request life cycle - before ASP.NET MVC has a chance to switch it off based on the attribute value. Check out the "breaking changes in ASP.NET 4" documentation on the ASP.NET web site:
http://www.asp.net/learn/whitepapers/aspnet4/breaking-changes/#_TOC7

You can switch the request validation feature to go back to the "old" behavior with a web.config setting. This will get you the behavior that you saw in ASP.NET 3.5 (despite the setting being called "2.0").

Thanks,
The ASP.NET Team

Thank you for reporting the issue.
We were able to reproduce the issue with the detailed steps you provided.We are routing this issue to the appropriate group within the Visual Studio Product Team for triage and resolution. These specialized experts will follow-up with your issue.

The Url
/home/test/33:f

The Code:
        [ValidateInput(false)]
        public ActionResult Test(string id)
        {
            ViewData["test"] = id;
            return View();
        }

The Error:

[HttpException (0x80004005): A potentially dangerous Request.Path value was detected from the client (:).]
System.Web.HttpRequest.ValidateInputIfRequiredByConfig() +8815985
System.Web.PipelineStepManager.ValidateHelper(HttpContext context) +59
--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:4.0.30128; ASP.NET Version:4.0.30128.1

Thank you for your feedback, we are currently reviewing the issue you have submitted. If this issue is urgent, please contact support directly(http://support.microsoft.com)