URL Routing, Image Handler & "A potentially dangerous Request.Path value"

Question

I've been experiencing this problem now for quite sometime and have decided to try and get to the bottom of it once and for all by posting the question here for some thought. I have an image handler in a .net 4 website located here:

https://www.amadeupurl.co.uk/ImageHandler.ashx?i=3604 (actual domain removed for privacy)

Now this works fine and serves an image from the web server without problem, I say without problem because if I access the URL it works fine, the image loads, no exception is generated. However someone did visit this exact URL yesterday and an exception was raised along the following lines:

Exception Generated Error Message: A potentially dangerous Request.Path value was detected from the client (?). Stack Trace: at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)  Technical Information: DATE/TIME: 23/01/2013 03:50:01 PAGE: www.amadeupurl.co.uk/ImageHandler.ashx?i=3604 

I understand the error message, thats not a problem I just don't understand why it being generated here, to make things worse I'm unable to replicate it, like I said I click the link the image loads, no exception. I am using URL routing and registered the handler to be ignored in case this was causing an issue with the following code:

routes.Ignore("{resource}.ashx") 

I'm not sure why else I would be getting the error or what else to try.

Answer 1

Asp.Net 4.0+ comes with a very strict built-in request validation, part of it is the potential dangerous characters in the url which may be used in XSS attacks. Here are default invalid characters in the url :

< > * % & : \ ?

You can change this behavior in your config file:

<system.web>     <httpRuntime requestPathInvalidCharacters="<,>,*,%,&,:,\,?" /> </system.web> 

Or get back to .Net 2.0 validation:

<system.web>     <httpRuntime requestValidationMode="2.0" /> </system.web> 

A very common invalid character is %, so if by any chance (attack, web-crawlers, or just some non-standard browser) the url is being escaped you get this:

www.amadeupurl.co.uk/ImageHandler.ashx/%3Fi%3D3604 

instead of this:

www.amadeupurl.co.uk/ImageHandler.ashx/?i=3604 

Note that %3F is the escape character for ?. The character is considered invalid by Asp.Net request validator and throws an exception:

A potentially dangerous Request.Path value was detected from the client (?). 

Though in the error message you see the unescaped version of the character (%3F) which is ? again

Here's a good article on Request Validation and how to deal with it