Parameter validation in Visualforce to prevent “Illegal Request”

Question

I have a very simple public force.com site (lets use the subdirectory mypublicsite), that accepts a single parameter. Since the site is public, users may send malicous content through this parameter. I already found out, that % is one of these illegal strings. If I try to access the page in preview mode (as an interal user) like this

https://my-custom-company-domain.visualforce.com/apex/mypublicsite?Id=%

I receive the following error:

If I try to access the page as the actual public page ...

https://my-custom-company-domain.force.com/mypublicsite?Id=%

I see the following ugly maintenance notice:

So the question is: How to validate URL parameters in a way, that invalid input will not break the whole visualforce page?

Answer 1

Answer: you can't. Before any code at all has a chance to execute, Site.com performs several sanity checks on the input, such as an invalid URL. This feature is specifically intended to hide any error messages that would otherwise appear, potentially leaking sensitive data to unauthenticated users. Imagine if, for example, a user got a "null pointer exception" with a stack trace, they could figure out a bit about what your code does and try to abuse it. By showing a simple "down for maintenance" error, it makes such examinations less useful to attackers.

However...

You can change the maintenance and error pages to display whatever you'd like. If you really want to tell the users that an error occurred, you can. The "ugly page" is only a default, and really is meant to be replaced by something more beautiful. See Setup > Develop > Sites > (site name) > Error Pages to choose which pages are shown and even edit them to suit your business needs.

Just be aware that intentionally malicious attempts, such as a malformed URL, will simply see a generic "page not found" error instead of the real message. Again, this is a security feature, and you probably should not attempt to handle those situations directly. I'm simply trying to make you aware of the fact that Site.com error pages are fully customizable. You can add error logging, custom branding, etc, so that the site suits your business needs.