Je suis looking for tout kind of solution to properly get an IIS request such as [https://stackoverflow.com/%](https://stackoverflow.com/%) et [http://bing.com/%](http://bing.com/%) to pas display a 400 Bad Request page, mais display a custom error page similaire to how [http://google.com/%](http://google.com/%) et [http://facebook.com/%](http://facebook.com/%) do (obviously those examples are pas on IIS).
Je crois J'ai tried setting tous le applicable http.sys registry settings (AllowRestrictedChars, PercentUAllowed) per [http://support.microsoft.com/kb/820129](http://support.microsoft.com/kb/820129) mais that has pas helped. Setting AllowRestrictedChars et a custom 400 page has fixed urls such as [https://stackoverflow.com/%12](https://stackoverflow.com/%12) mais pas /%.
Gérer correctement les requêtes IIS avec le signe pourcentage dans l'URL (/%)
Re: Gérer correctement les requêtes IIS avec le signe pourcentage dans l'URL (/%)
Ceci est blocked right in le IIS kernel level. As a test I pulled out *every* module in IIS so that it didn't even have a static page handler, et it encore displayed le 400 error message.
Je ne believe c'est possible avec IIS to get around that. The registry settings you mentioned are for autre types of restricted characters. I n'ont pas seen a lever to change that functionality.
Quel est votre goal is avoiding that? It opens votre attack surface wider, et Je ne peux pas imagine a legit visitor being lost en conséquence of blocking incomplete URL escape sequences.
**Update2:**
Here are three great links on this. Both Nazim Lala et Wade Hilmo depuis le IIS team have blogged about this parce que of discussion around votre question. Also Scott Hanselman has a great post on le querystring part within .NET:
- [Use of Special Characters in IIS](http://blogs.iis.net/nazim/archive/2011/04/18/use-of-special-characters-like-in-an-iis-url.aspx) - Nazim Lala
- [How IIS block characters in URLs](http://blogs.iis.net/wadeh/archive/2011/04/20/how-iis-blocks-characters-in-urls.aspx?CommentPosted=true#commentmessage) - Wade Hilmo
- [Experiments in Wackiness](http://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx) - Scott Hanselman
**Mise à jour :**
I checked avec a member of le IIS team to get an authoritative answer. He mentioned that le % is considered an unsafe character according to RFC 1738 ([http://www.ietf.org/rfc/rfc1738.txt](http://www.ietf.org/rfc/rfc1738.txt)).
Voici le relevent text:
>
Unsafe:
Characters can be unsafe for a number
of reasons. The space character is
unsafe parce que significant spaces may
disappear et insignificant spaces may
be introduced quand URLs are
transcribed ou typeset ou subjected to
le treatment of word-processing
programs. The characters "<" et ">"
are unsafe parce que they are used as
le delimiters around URLs in free
text; le quote mark (""") is used to
delimit URLs in certains systems. The
character "#" is unsafe et should
toujours be encoded parce que it is used
in World Wide Web et in autre systems
to delimit a URL depuis a
fragment/anchor identifier that might
follow it. **The character "%" is
unsafe parce que it is used for
encodings of autre characters.** Other
characters are unsafe parce que gateways
et autre transport agents are known
to sometimes modify such characters.
These characters are "{", "}", "|",
"\", "^", "~", "[", "]", et "`".
All unsafe characters must toujours be
encoded within a URL. Par exemple, the
character "#" must be encoded within
URLs even in systems that do not
normally deal avec fragment ou anchor
identifiers, so that si le URL is
copied into another system that does
use them, it will pas be nécessaire to
changez le URL encoding.
So IIS proactively blocks this up at le core level, a proactive security measure to minimize leur attack surface.
Je ne believe c'est possible avec IIS to get around that. The registry settings you mentioned are for autre types of restricted characters. I n'ont pas seen a lever to change that functionality.
Quel est votre goal is avoiding that? It opens votre attack surface wider, et Je ne peux pas imagine a legit visitor being lost en conséquence of blocking incomplete URL escape sequences.
**Update2:**
Here are three great links on this. Both Nazim Lala et Wade Hilmo depuis le IIS team have blogged about this parce que of discussion around votre question. Also Scott Hanselman has a great post on le querystring part within .NET:
- [Use of Special Characters in IIS](http://blogs.iis.net/nazim/archive/2011/04/18/use-of-special-characters-like-in-an-iis-url.aspx) - Nazim Lala
- [How IIS block characters in URLs](http://blogs.iis.net/wadeh/archive/2011/04/20/how-iis-blocks-characters-in-urls.aspx?CommentPosted=true#commentmessage) - Wade Hilmo
- [Experiments in Wackiness](http://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx) - Scott Hanselman
**Mise à jour :**
I checked avec a member of le IIS team to get an authoritative answer. He mentioned that le % is considered an unsafe character according to RFC 1738 ([http://www.ietf.org/rfc/rfc1738.txt](http://www.ietf.org/rfc/rfc1738.txt)).
Voici le relevent text:
>
Unsafe:
Characters can be unsafe for a number
of reasons. The space character is
unsafe parce que significant spaces may
disappear et insignificant spaces may
be introduced quand URLs are
transcribed ou typeset ou subjected to
le treatment of word-processing
programs. The characters "<" et ">"
are unsafe parce que they are used as
le delimiters around URLs in free
text; le quote mark (""") is used to
delimit URLs in certains systems. The
character "#" is unsafe et should
toujours be encoded parce que it is used
in World Wide Web et in autre systems
to delimit a URL depuis a
fragment/anchor identifier that might
follow it. **The character "%" is
unsafe parce que it is used for
encodings of autre characters.** Other
characters are unsafe parce que gateways
et autre transport agents are known
to sometimes modify such characters.
These characters are "{", "}", "|",
"\", "^", "~", "[", "]", et "`".
All unsafe characters must toujours be
encoded within a URL. Par exemple, the
character "#" must be encoded within
URLs even in systems that do not
normally deal avec fragment ou anchor
identifiers, so that si le URL is
copied into another system that does
use them, it will pas be nécessaire to
changez le URL encoding.
So IIS proactively blocks this up at le core level, a proactive security measure to minimize leur attack surface.