URL 路由、图像处理程序和“一个潜在危险的 Request.Path 值" [英] URL Routing, Image Handler & "A potentially dangerous Request.Path value"

问题描述

我已经遇到这个问题有一段时间了，并决定尝试通过在此处发布问题进行一些思考来一劳永逸地找出问题的根源.我在位于此处的 .net 4 网站中有一个图像处理程序:

I've been experiencing this problem now for quite sometime and have decided to try and get to the bottom of it once and for all by posting the question here for some thought. I have an image handler in a .net 4 website located here:

https://www.amadeupurl.co.uk/ImageHandler.ashx?我=3604(出于隐私考虑删除了实际域)

https://www.amadeupurl.co.uk/ImageHandler.ashx?i=3604 (actual domain removed for privacy)

现在这工作正常并且从网络服务器提供图像没有问题，我说没有问题，因为如果我访问 URL 它工作正常，图像加载，不会生成异常.然而，昨天确实有人访问了这个确切的 URL，并引发了以下几行的异常:

Now this works fine and serves an image from the web server without problem, I say without problem because if I access the URL it works fine, the image loads, no exception is generated. However someone did visit this exact URL yesterday and an exception was raised along the following lines:

Exception Generated
Error Message:
A potentially dangerous Request.Path value was detected from the client (?).
Stack Trace:
at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)

Technical Information:
DATE/TIME: 23/01/2013 03:50:01
PAGE: www.amadeupurl.co.uk/ImageHandler.ashx?i=3604

我理解错误消息，那不是问题，我只是不明白为什么会在此处生成它，更糟糕的是我无法复制它，就像我说的我单击图像加载的链接一样，也不例外.我正在使用 URL 路由并注册了要忽略的处理程序，以防这导致以下代码出现问题:

I understand the error message, thats not a problem I just don't understand why it being generated here, to make things worse I'm unable to replicate it, like I said I click the link the image loads, no exception. I am using URL routing and registered the handler to be ignored in case this was causing an issue with the following code:

routes.Ignore("{resource}.ashx")

我不知道为什么我会收到错误或其他什么尝试.

I'm not sure why else I would be getting the error or what else to try.

推荐答案

Asp.Net 4.0+ 自带非常严格的内置请求验证，部分原因是 url 中可能会被 XSS 使用的潜在危险字符攻击.以下是 url 中的默认无效字符:

Asp.Net 4.0+ comes with a very strict built-in request validation, part of it is the potential dangerous characters in the url which may be used in XSS attacks. Here are default invalid characters in the url :

<代码><>* % &: ?

您可以在配置文件中更改此行为:

You can change this behavior in your config file:

<system.web>
    <httpRuntime requestPathInvalidCharacters="<,>,*,%,&,:,,?" />
</system.web>

或者回到 .Net 2.0 验证:

Or get back to .Net 2.0 validation:

<system.web>
    <httpRuntime requestValidationMode="2.0" />
</system.web>

一个非常常见的无效字符是 %，所以如果有任何机会(攻击、网络爬虫或一些非标准浏览器)url 被转义，你会得到这个:

A very common invalid character is %, so if by any chance (attack, web-crawlers, or just some non-standard browser) the url is being escaped you get this:

www.amadeupurl.co.uk/ImageHandler.ashx/%3Fi%3D3604

而不是这个:

www.amadeupurl.co.uk/ImageHandler.ashx/?i=3604

注意%3F是?的转义符.Asp.Net 请求验证器认为该字符无效并引发异常:

Note that %3F is the escape character for ?. The character is considered invalid by Asp.Net request validator and throws an exception:

A potentially dangerous Request.Path value was detected from the client (?).

尽管在错误消息中您再次看到了字符 (%3F) 的未转义版本，即 ?

Though in the error message you see the unescaped version of the character (%3F) which is ? again

这是一篇关于请求验证以及如何处理它的好文章

这篇关于URL 路由、图像处理程序和“一个潜在危险的 Request.Path 值"的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！