URL Routing, Image Handler & “A potentially dangerous Request.Path value”

by

Asp.Net 4.0+ comes with a very strict built-in request validation, part of it is the potential dangerous characters in the url which may be used in XSS attacks. Here are default invalid characters in the url :

< > * % & : \ ?

You can change this behavior in your config file:

<system.web>
    <httpRuntime requestPathInvalidCharacters="<,>,*,%,&,:,\,?" />
</system.web>

Or get back to .Net 2.0 validation:

<system.web>
    <httpRuntime requestValidationMode="2.0" />
</system.web>

A very common invalid character is %, so if by any chance (attack, web-crawlers, or just some non-standard browser) the url is being escaped you get this:

www.amadeupurl.co.uk/ImageHandler.ashx/%3Fi%3D3604

instead of this:

www.amadeupurl.co.uk/ImageHandler.ashx/?i=3604

Note that %3F is the escape character for ?. The character is considered invalid by Asp.Net request validator and throws an exception:

A potentially dangerous Request.Path value was detected from the client (?).

Though in the error message you see the unescaped version of the character (%3F) which is ? again

Here’s a good article on Request Validation and how to deal with it

More Related Contents:

  1. Store String Array In appSettings?
  2. The configuration section ‘system.web.extensions’ cannot be read because it is missing a section declaration
  3. How to configure SMTP settings in web.config
  4. Editing Web.config programmatically
  5. What is the best way to read/parse the XML files [closed]
  6. Japenese character in a filename changes to garbage if I download file from IE 11
  7. Using different Web.config in development and production environment
  8. Access-control-allow-origin with multiple domains
  9. Forms authentication timeout vs sessionState timeout
  10. What is the App_Data folder used for in Visual Studio?
  11. Setting up connection string in ASP.NET to SQL SERVER
  12. ASP.NET web.config: configSource vs. file attributes
  13. How serious is this new ASP.NET security vulnerability and how can I workaround it?
  14. Why order matters in this RegEx with alternation?
  15. Reading web.config from JavaScript
  16. ASP.NET Web API 2: How do I log in with external authentication services?
  17. MemoryCache Empty : Returns null after being set
  18. Login failed for user ‘NT AUTHORITY\NETWORK SERVICE’
  19. Preventing SQL Injection in ASP.Net
  20. .NET Configuration (app.config/web.config/settings.settings)
  21. Stopping onclick from firing when onclientclick is false?
  22. Encrypting Web.Config
  23. Streaming Databased Images Using HttpHandler
  24. ASP.NET Web Site or ASP.NET Web Application?
  25. IFrame: This content cannot be displayed in a frame
  26. web.config and app.config confusion
  27. Specify more than one directory in Web.Config’s Location Path element
  28. How do I get msdeploy to create App_Data if it doesn’t exist, but not delete any contents of the remote directory?
  29. AspNetSynchronizationContext
  30. How can I reference an appSetting in a different part of web.config

Leave a Comment