double escape sequence inside a url : The request filtering module is configured to deny a request that contains a double escape sequence

by

The security holes that you might open up have to do with code injection – HTML injection, JavaScript injection or SQL injection.

The default settings protect you from attacks semi-efficiently by not allowing common injection strategies to work. The more default security you remove, the more you have to think about what you do with the input provided through URLs, GET request querystrings, POST request data, HTTP headers and so on…

For instance, if you are building dynamic SQL queries based on the id parameter of your action method, like this:

public ActionResult Tags(string id)
{
    var sql = "SELECT * FROM Tags Where tagName="" + id + """;
    // DO STUFF...
}

(…which is NOT a good idea), the default protection, put in place by the .NET framework, might stop some of the more dangerous scenarios, like the user requesting this URL:

/product/tags/1%27;drop%20table%20Tags;%20--

The whole idea is to treat every part of urls and other inputs to action methods as possible threats. The default security setting does provide some of that protection for you. Each default security setting you change opens up for a little more potential badness that you need to handle manually.

I assume that you are not building SQL queries this way. But the more sneaky stuff comes when you store user input in your database, then later displaying them. The malevolent user could store JavaScript or HTML in your database that go out unencoded, which would in turn threaten other users of your system.

More Related Contents:

  1. What is the difference between ‘classic’ and ‘integrated’ pipeline mode in IIS7?
  2. Asp.NET Web API – 405 – HTTP verb used to access this page is not allowed – how to set handler mappings
  3. IIS7 – The request filtering module is configured to deny a request that exceeds the request content length
  4. Diagnosing 404 errors on IIS 7 and ASP.NET MVC
  5. Injecting content into specific sections from a partial view ASP.NET MVC 3 with Razor View Engine
  6. include antiforgerytoken in ajax post ASP.NET MVC
  7. How do I resolve “HTTP Error 500.19 – Internal Server Error” on IIS7.0 [closed]
  8. How to increase request timeout in IIS?
  9. IIS7 Cache-Control
  10. How to render a DateTime in a specific format in ASP.NET MVC 3?
  11. ASP.NET 4.5 MVC 4 not working on Windows Server 2008 IIS 7
  12. IIS URL Rewriting vs URL Routing
  13. Is it possible to access MVC Views located in another project?
  14. ASP.NET MVC Url Route supporting (dot)
  15. mvc uppercase Model vs lowercase model
  16. Global ASAX – get the server name
  17. Infinite URL Parameters for ASP.NET MVC Route
  18. How to warm up an ASP.NET MVC application on IIS 7.5?
  19. How to set up subdomains on IIS 7
  20. Get DisplayName Attribute without using LabelFor Helper in asp.net MVC
  21. Adding sub-directory to “View/Shared” folder in ASP.Net MVC and calling the view
  22. ASP.NET 5 project hosting on IIS
  23. ViewModel’s list is null in action
  24. What does ‘IISReset’ do?
  25. User ASP.NET runs under
  26. ASP.NET MVC3 Role and Permission Management -> With Runtime Permission Assignment
  27. ASP.NET session state and multiple worker processes
  28. IValidatableObject Validate method firing when DataAnnotations fails
  29. ASP.NET: HTTP Error 500.19 – Internal Server Error 0x8007000d
  30. How do I Configure IIS to accept POST requests?

Leave a Comment