ASP.NET MVC

Re: Bug in Url Building

shopvisible — Fri, 09 May 2008 00:18:19 GMT

Our CMS generates flat URLs based upon the name. In this example, the customer did enter in Cutlery & Accessories, which we convert to Cutlery-&-Accessories. This has worked from IIS 3 thru 6 and only now is an issue. There must be a setting in IIS 7 to ignore the &?

Re: Bug in Url Building

ariyawansa@gmail.com — Fri, 09 May 2008 00:03:06 GMT

Hi,

Depending on the requirement, you may be bale to get a way by a simple find and replace technique I used in few pages, as long as your not depending on the text that your passing via Query parameter. I assume that you need this to build the XML sitemap.

Example.

Public address: (Assuming the id for “Cutlery-&-Accessories” is 14)

/Cutlery and Accessories/14/Cutlery-and-Accessories.asp

Real address:

/Cutlery/productList.asp?categoryid=$2

The Regexp:

/(.{1,})/ ([0-9]+)/ (.{1,}) (\.htm|\.html)

Since your passing the ID to the page, there is no reason that you cannot replace “&” with “And” or a " ", you can still get the description with a DB call by ID.

however as i said it's depending on your requirement.

Cheers and Good luck

Krish

Re: Bug in Url Building

shopvisible — Thu, 08 May 2008 21:01:16 GMT

It seems the 1st setting for allowingRestrictedChars would be the right answer, but this article pertains to IIS 6.0, do you think it will have the similar result on IIS 7?

Re: Bug in Url Building

ksirg — Thu, 08 May 2008 20:41:07 GMT

Oh sorry, when I set all three things :

AllowRestrictedChars http://support.microsoft.com/kb/820129
VerificationCompatibility - http://support.microsoft.com/default.aspx?scid=kb;EN-US;826437 without instaling service pack 1 to .net 1.1
and set on asp.net page ValidateRequest=false

its start working :)

I hope that helps.

Re: Bug in Url Building

ksirg — Thu, 08 May 2008 20:17:55 GMT

I try all methods above, even change some settings in registry and nothing help.

When I enter on my website on localhost I see

Error Summary
HTTP Error 400.0 - Bad Request
ASP.NET detected invalid characters in the URL.
Detailed Error Information
Module    WindowsAuthentication
Notification    AuthenticateRequest
Handler    StaticFile
Error Code    0x00000000
Requested URL    http://site.com:80/producenci/H&M
Physical Path    D:\ftp\LocalUser\szafa\web\producenci\H&M
Logon Method    Not yet determined
Logon User    Not yet determined

I wonder why it choose StaticFile handler to serve my request, shouldn't be some MvcHandler?
And why it use WindowsAuthentication module in that request

When it will be next version of asp.mvc?

Re: Bug in Url Building

shopvisible — Thu, 08 May 2008 19:11:20 GMT

Hi. I am having a similar issue in a test site in IIS 7. A URL such as: <SITENAME>/Cutlery-&-Accessories/Cutlery-&-Accessories.asp which has always worked in IIS6 and earlier suddenly no longer works in IIS 7, giving an error 400 as below. The confusing thing to me is that it says asp.net detected the invalid characters, but this is a classic asp page, have I set something up improperly?

HTTP Error 400.0 - Bad Request

ASP.NET detected invalid characters in the URL.

Detailed Error Information

Module	ScriptModule
Notification	AuthenticateRequest
Handler	ASPClassic
Error Code	0x00000000

Requested URL	http://servu.shopvisible.net:80/Cutlery-&-Accessories/Cutlery-&-Accessories.asp
Physical Path	d:\shopvisible\sites\ServU-ShopVisible\Cutlery-&-Accessories\Cutlery-&-Accessories.asp
Logon Method	Not yet determined
Logon User	Not yet determined

Re: Bug in Url Building

ariyawansa@gmail.com — Fri, 02 May 2008 03:54:18 GMT

Even though you encode the URL, Asp.Net page has a default behavior of rejecting suspicious request. Although its not recommended for pages that your absolutely sure of can be rendered by changing the page directive ValidateRequest.

<%@ Page Language="C#" ValidateRequest="false" MasterPageFile="~/Site.master" AutoEventWireup="true" CodeFile="DealerDetails.aspx.cs" Inherits="Dealer_DealerDetails" Title="Untitled Page" %>

Cheers

Re: Bug in Url Building

superevanc — Tue, 15 Apr 2008 18:12:52 GMT

What you might be running into probably isn't an ASP.NET MVC issue. From what you describe it sounds like you are running into some of the IIS security features that block out potential attack urls.

Take a look at http://support.microsoft.com/kb/820129 and the AllowRerstrictedChars setting also http://support.microsoft.com/default.aspx?scid=kb;EN-US;826437

Hope that helps track down your problem.

Re: Bug in Url Building

ksirg — Tue, 08 Apr 2008 18:08:21 GMT

I use mix version and my routes don't have ".mvc" extensions.

And mvc do HtmlAttributeEncode not UrlEncode

HtmlHelper.cs line 121

return String.Format(CultureInfo.InvariantCulture, _anchorTag, HttpUtility.HtmlAttributeEncode(url), HttpUtility.HtmlEncode(linkText));

Re: Bug in Url Building

developmentalmadness — Mon, 07 Apr 2008 15:03:39 GMT

Also, have you checked to see if you are using the ".mvc" extension in your url? It isn't required on IIS 7.0, so if you are you can make sure to remove it. But just verify that your routes take the difference into account.

Re: Bug in Url Building

developmentalmadness — Mon, 07 Apr 2008 14:49:46 GMT

Which version are you using? The latest version automatically UrlEncodes the values in the path. Make sure you are using the MIX release (early march) and remove the call to UrlEncode.

Re: Bug in Url Building

ksirg — Sun, 06 Apr 2008 15:22:16 GMT

I have the same issue. On my localhost machine it's ok but on iis7 it throw "Bad Request"

I try all methods above and also UrlEncodeUnicode

Is there any solution for that ? Maybe it's iis problem? Have you try with normal asp.net app?

Re: Bug in Url Building

sliderhouserules — Mon, 11 Feb 2008 19:01:44 GMT

KaziManzurRashid:
I tried the foolowing prior posting this issue, i have added the result:

Server.UrlEncode(tagItem.Name) -> Story/Tag/Business+%26+Finance/1 -> Html Error 400 - Bad Request

Html.Encode(tagItem.Name) -> Story/Tag/Business%20&%20Finance/1 -> Html Error 400 - Bad Request

HttpUtility.UrlEncode(tagItem.Name) -> Story/Tag/Business+%26+Finance/1 -> Html Error 400 - Bad Request

HttpUtility.UrlPathEncode(tagItem.Name) -> Story/Tag/Business%20&%20Finance/1 -> Html Error 400 - Bad Request

Any other workaround ?

The above highlighted ampersands are exactly what I was referring to. Ampersands are used to delimit query string parameters.

The fact that you're getting HTTP 400 when you correctly encode the ampersand means there's something else going on. I just wanted to clarify what I was saying.

Re: Bug in Url Building

KaziManzurRashid — Mon, 11 Feb 2008 18:55:32 GMT

I tried the foolowing prior posting this issue, i have added the result:

Server.UrlEncode(tagItem.Name) -> Story/Tag/Business+%26+Finance/1 -> Html Error 400 - Bad Request

Html.Encode(tagItem.Name) -> Story/Tag/Business%20&%20Finance/1 -> Html Error 400 - Bad Request

HttpUtility.UrlEncode(tagItem.Name) -> Story/Tag/Business+%26+Finance/1 -> Html Error 400 - Bad Request

HttpUtility.UrlPathEncode(tagItem.Name) -> Story/Tag/Business%20&%20Finance/1 -> Html Error 400 - Bad Request

Any other workaround ?

Re: Bug in Url Building

developmentalmadness — Mon, 11 Feb 2008 15:45:37 GMT

I agree, I think you've found a bug. But I believe what sliderhouserules meant was UrlEncode it before you pass it as an argument, like this:

Url.Action(new { action = "Tag", controller = "Story", name = HttpUtility.UrlEncode(tagItem.Name), page = 1 })

Url.Action(new { action = "Tag", controller = "Story", name = Server.UrlEncode(tagItem.Name), page = 1 })

Using HttpUtility.UrlEncode is a security best practice according to msdn to protect against cross-site scripting attacks, but I haven't seen it used much so I don't know how well it actually works. And even the MVC framework uses both interchangeably, but since I've started using it I haven't had any problems.