In our ASP.NET MVC application, we've noticed that we cannot have The Forbidden DOS File Names—COM1 through COM9, LPT1 through LPT9, CON, AUX, PRN, and NUL—anywhere in our routes. They inevitably result in IIS telling us the file cannot be found, even when we set routing not to check for the existence of files first. How can we work around this?
Asked
Active
Viewed 5,127 times
42
Benjamin Pollack
- 27,594
- 16
- 81
- 105
-
11For fun, hit http://stackoverflow.com/com1 and compare to http://stackoverflow.com/ThisDoesNotExist – kamens Jun 12 '09 at 15:09
-
interestingly, stackoverflow.com/clock$ works fine, even though CLOCK$ is a reserved device filename as well. – Jacob Krall Jun 12 '09 at 15:30
-
12And leveraging this knowledge, I have now successfully made it impossible to navigate to my user page. Woot. – Benjamin Pollack Jun 12 '09 at 16:49
-
3I like how you DOS'd yourself. – Michael Pryor Jun 12 '09 at 21:15
-
2Very cool; but not impossible - the username isn't required in the user info route ;) – Tom Ritter Jun 12 '09 at 21:27
-
2http://www.microsoft.com/com1.aspx )) – Sergey Mirvoda Apr 30 '10 at 19:16
-
I was wondering why when someone added a tag for "con" (short for convention, as in comic-con) on my site I couldn't get to tags/con. +1 to both this Q and the A. – WildJoe May 11 '10 at 08:12
-
Ran into this problem again... but found that http://stackoverflow.com/questions/987105/asp-net-mvc-routing-vs-reserved-filenames-in-windows/2746438#2746438 was the correct solution. Think that the accepted answer could be changed/updated? – John Nelson Nov 09 '10 at 20:40
4 Answers
38
This has been addressed in ASP.NET 4. http://haacked.com/archive/2010/04/29/allowing-reserved-filenames-in-URLs.aspx
You can apply a setting in web.config that relaxes this restriction.
<configuration>
<system.web>
<httpRuntime relaxedUrlToFileSystemMapping="true"/>
<!-- ... your other settings ... -->
</system.web>
</configuration>
Hope that helps.
Haacked
- 58,045
- 14
- 90
- 114
-
@thekaid: Backwards compatibility: MS cannot be certain no-one depends on the old behaviour. – Richard May 04 '10 at 11:05
-
1@thekaido What Richard said is exactly right. You'd be surprised at the types of bugs people start to rely on. – Haacked May 10 '10 at 03:32
18
Since asking the question, I've found that the bug is in ASP.NET proper, not IIS or ASP.NET MVC, meaning that there's no way to work around it. The only solution is to manually forbid URLs matching these names and these names followed by a period and random characters.
Benjamin Pollack
- 27,594
- 16
- 81
- 105
-
3Yup. :) The ASP.NET team is aware of this bug and is looking into it for ASP.NET 4. Can't guarantee if it will be fixed, but at least there is interest in making this better for developers. – Levi Jun 13 '09 at 01:09
4
For a similar reason, there can't be a web.config tag in StackOverflow.
http://stackoverflow.uservoice.com/pages/1722-general/suggestions/98871-web-config-tag-404-error
CoderDennis
- 13,642
- 9
- 69
- 105
0
for another similar reason you can't have urls with a dot and a slash Semantic urls with dots in .net
