Enable asp.net core request validation
<p>Am I missing something or asp.net core allows to post script tag in user text fields? In Previous versions of asp.net mvc I needed to allow it by [AllowHtml] attribute.</p>

<p>Is there a way how enable validation agains potentially dangerous values?</p>

<p>I'm free to submit value like</p>

<pre><code>&lt;script src='http://test.com/hack.js'&gt;&lt;/script&gt;
</code></pre>

<p>during form post.</p>

<p>Model:</p>

<pre><code>using System.ComponentModel.DataAnnotations;

namespace Test.Models
{
    public class TestModel
    {
        [MaxLength(500)]
        public string Content { get; set; }
    }
}
</code></pre>

<p>Controller:</p>

<pre><code>using Microsoft.AspNetCore.Mvc;
using Test.Models;

namespace Test.Controllers
{
    public class HomeController : Controller
    {
        public IActionResult Index()
        {
            var model = new TestModel { Content = "Test" };
            return View();
        }

        [HttpPost]
        public IActionResult Index(TestModel model)
        {
            if(!ModelState.IsValid)
                return View(model);

            return Content("Success");
        }
    }
}
</code></pre>

<p>View:</p>

<pre><code>@model TestModel

&lt;form asp-action="Index" asp-controller="Home" method="post"&gt;
    &lt;div asp-validation-summary="All"&gt;&lt;/div&gt;
        &lt;label asp-for="Content"&gt;Content&lt;strong&gt;*&lt;/strong&gt;&lt;/label&gt;
        &lt;span asp-validation-for="Content"&gt;&lt;/span&gt;
        &lt;input asp-for="Content" type="text" /&gt;
    &lt;/div&gt;
&lt;/form&gt;
</code></pre>