28

We are having an issue where our application fails when the URL has any part ending with '.' in it'; we can't avoid this due to functional requirements. The suggested solution is to turn on relaxedUrlToFileSystemMapping in web.config file. We would like to know if there are any potential security risks with this approach.

Format of failing URL: http://server.com/path1/krishnakk./path2

It returns a 404 error.

Pang
  • 9,564
  • 146
  • 81
  • 122
Krishna Kumar
  • 7,841
  • 14
  • 49
  • 61

2 Answers2

15

Even though this question is seven months old, here's an answer in case anyone else comes across a situation like this.

Regarding the security part of the question, by default relaxedUrlToFileSystemMapping is set to false, and ASP .NET assumes that the path portion of a URL is a valid NTFS file path. If you disable this by setting relaxedUrlToFileSystemMapping to true, then you are potentially opening your site up to attack because you're disabling the default protection provided by ASP .NET.

If you absolutely need to set relaxedUrlToFileSystemMapping to true you should also be sure that you validate all URLs within the constraints of your application's requirements.

Jack
  • 1,319
  • 8
  • 16
  • 21
    To save others some time, the above warnings by Hanselman (whom I respect highly) are unfortunately pretty non-specific, I might even say cargo-culting style. Like "this may void your warranty" and "better not do this but I won't say why". If there's a specific attack vector, mention it!... – Roman Starkov Oct 03 '14 at 23:46
  • 3
    Could you be more specific regarding the attack? – Dmitry Dec 06 '14 at 19:24
  • 2
    http://blog.detectify.com/post/82370846588/how-we-got-read-access-on-googles-production and https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing explain one possible attack vector (although not specific to ASP.NET). – Joseph Yaduvanshi Mar 19 '15 at 13:08
1

A little late to the party but I thought I'd add what worked for me.

I just ran into this today, but fortunately was able to work around it. The solution was to pass the value that contained the dot (period) as part of the querystring, not the URL. You lose the elegance of having a clean URI without querystring, but it works without lowering security or changing any settings.

E.g. http://localhost/Home/hi.how:areyou will fail because it contains two illegal chars as part of the URI, the dot and the colon. However http://localhost/Home/id=hi.how:areyou will work perfectly.

Props to Scott Hanselman that, as always, will have blogged about pretty much all crazy scenarios and issues that one might run into while doing .NET development.

GR7
  • 5,083
  • 8
  • 48
  • 66