Groups | Blog | Home
all groups > iis security > june 2005 >

iis security : IIS 6 and % characters in a URL


jeff.nospam NO[at]SPAM zina.com
6/6/2005 12:00:00 AM
On Mon, 6 Jun 2005 05:17:17 -0700, "Sean O'Callaghan" <Sean
[quoted text, click to view]

The percent character "%" doesn't work because it indicates an ASCII
character code follows. So this URL:

http://www.sample.com/discount%2005.htm

Actually translates to this:

http://www.sample.com/discount 05.htm

That's not the name of the file so it doesn't get found.

Don't use the percent character in file names.

Sean O'Callaghan
6/6/2005 5:17:17 AM
Hi All,
if you have a file name with a % in iis blocks the request and i cant find
where to change it, it's not urlscan but a core option.

jeff.nospam NO[at]SPAM zina.com
6/7/2005 12:00:00 AM
On Tue, 7 Jun 2005 00:08:01 -0700, "Sean"
[quoted text, click to view]

Got a log file entry as an example?

Jeff



[quoted text, click to view]
Ken Schaefer
6/7/2005 12:00:00 AM
[quoted text, click to view]
:
: >if you have a file name with a % in iis blocks the request and i cant
find
: >where to change it, it's not urlscan but a core option.
: >
: >Any idea where i can change this?
:
: The percent character "%" doesn't work because it indicates an ASCII
: character code follows. So this URL:
:
: http://www.sample.com/discount%2005.htm
:
: Actually translates to this:
:
: http://www.sample.com/discount 05.htm
:

But %26 indicates a % right? :-)

Cheers
Ken

Sean
6/7/2005 12:08:01 AM
Hi Guys thanks for the info.

What i am refering to is if i have two files in the root of the wwwroot
folder one called sean%me.doc and one called sean_me.doc the later works but
the former does not, IIS is blocking the request and it gets ritten to the
http log files. URLSCAN use to block this, but i can;t find a setting in 6.0
to change this.

Cheers,
Sean

[quoted text, click to view]
AddThis Social Bookmark Button