Skip to content
This repository has been archived by the owner on Nov 1, 2018. It is now read-only.

HttpPlatformHandler forwards the path un-escaped, breaks for ? #33

Closed
Tratcher opened this issue Nov 11, 2015 · 3 comments
Closed

HttpPlatformHandler forwards the path un-escaped, breaks for ? #33

Tratcher opened this issue Nov 11, 2015 · 3 comments

Comments

@Tratcher
Copy link
Member

When HttpPlatformHandler forwards the request path and query, it uses the un-escaped path and the original escaped query. This causes a few issues:

  1. Query - If there is an escaped ? (%3F) in the original path it is un-escaped and forwarded. The back-end server (kestrel, weblistener) then interprets this as the query separator, breaking both path and query. There is no workaround.
  2. Backslash - %5C is unescaped to \ and then converted to /, confusing routing
  3. Double un-escaping - This would be a problem if you sent /%25%34%31, except IIS's request filtering logic blocks %25 by default.
@Tratcher
Copy link
Member Author

FYI @davidfowl @halter73

@Tratcher
Copy link
Member Author

Fixed by the next version of HttpPlatformHandler (v1.3?)

@Tratcher Tratcher removed their assignment Jan 21, 2016
@Tratcher Tratcher added the bug label Mar 25, 2016
@Tratcher
Copy link
Member Author

This as been fixed in AspNetCoreModule v0.8: #105.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant