How do I properly support colons (':') in URLs (WebApi within larger ASP.NET application)

Question

I want some of my ids to be colon-separated, which means that my URL paths have colons in them, e.g. /somethings/xyz:123.

I have removed : from requestPathInvalidCharacters, but now I have another problem. It seems there are several third-party modules in the outside application that get PhysicalPath or do MapPath on all requests, which seems to have problem with colons:

[NotSupportedException: The given path's format is not supported.]
   System.Security.Util.StringExpressionSet.CanonicalizePath(String path, Boolean needFullPath) +14633709
   System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) +351
   System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) +151
   System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) +38
   System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) +92
   System.Web.Hosting.HostingEnvironment.MapPath(VirtualPath virtualPath) +107

How do I resolve it without rewriting all those modules?

Take a look at this answer to see if it helps: http://stackoverflow.com/a/12085167/745969 — Tim, Nov 10 '14 at 04:45
I don't think it helps -- it vaguely states that "ASP.net does not allow colons", however if I disable all modules it works perfectly fine. The only question is if there is a better workaround (disabling all modules for a given URL?). — Andrey Shchekin, Nov 10 '14 at 04:57

score 1 · Accepted Answer · answered Nov 10 '14 at 22:35

1

I found the answer that fixes exceptions in PhysicalPath and MapPath (for all modules):

<httpRuntime ... relaxedUrlToFileSystemMapping="true" />

answered Nov 10 '14 at 22:35

Andrey Shchekin

21,101
19
94
162

score 0 · Answer 2 · answered Nov 10 '14 at 06:35

I haven't tested this myself but this might help. Check if this hotfix is installed - http://support2.microsoft.com/kb/932552

And then as per the document, you have to change the below registry settings.

After you apply this hotfix, you must enable it by setting the value of the VerificationCompatibility entry of the following registry subkey to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET

DWord Value Name: VerificationCompatibility 
Value Data: 1

How do I properly support colons (':') in URLs (WebApi within larger ASP.NET application)

2 Answers2