BUG?: Can't use an Asterisk (*) as a character when requesting a URL (page) from ASP.NET
File this in obscure. I'm trying to fix a bug filed against dasBlog where the guy has a Category in dasBlog called "WS-*"
He filed a bug saying that the CategoryView doesn't work, presumably because it has an asterisk. Now, I KNOW asterisks are allowed in values of querystrings, so this seemed weird to me.
Turns out he's using the UrlRewriting feature of DasBlog so he gets URLs like this:
http://localhost/DasBlog/CategoryView,category,WS-*.aspx
The idea is to fool search engines into thinking there are actual pages, instead of one page with an URL like:
http://localhost/DasBlog/CategoryView.aspx?category=WS-*
Here's where it gets weird. We use a thing called the UrlMappingModule to catch ALL requests (all the requests that are handled by ASP.NET) and then call app.Context.RewritePath(newPath) which routes, in this case, the request to CategoryView.
However, if an asterisk (*) appears anywhere IN THE (purported) FILENAME, ala CategoryView,category,WS-*.aspx then ASP.NET never hears about it, the HttpModule's BeginRequest never fires and I can't do crap about it. All I see is an HTTP 400 Bad Request.
So, without digging further, I can only assume that the ASPNET_ISAPI extension didn't think it was cool to pass the request on. Of course, when the * appears as a value int the QueryString, everything is cool.
What other component/filter/module upstream might be slapping this request down? I'm not running any thing special on this development box.
About Scott
Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.
About Newsletter
Only files with an asterisk and .aspx extensions showed this behavior for me, which leads me into thinking ASPNET_ISAPI is trying to do something else other than serving the file. This was even more interesting on my local box, where IE popped-up a user/password/domain dialog (for which even the local admin credentials failed), possibly indicating it was trying to perform a "DIR" or something like it...
I have nothing to support all this guessing, though.
FIX: "HTTP 400 - Bad request" error message in the .NET Framework 1.1
http://support.microsoft.com/default.aspx?scid=kb;EN-US;826437
All of the characters mentioned in the KB article (* % &) also give me a 400 error if URLScan is not installed. If URLScan is installed, it may block some of those characters (such as %) and give you a 404 error.
Kevin - That article is definitely it. I can feel it. ;) Thanks for finding that.
My conclusion is that I'm not that interested in fixing this that I'm going to install a HotFix or messed with any "compatibility" flags.
Comments are closed.
"The guy" in your post will just rename his category from WS-* to WS-Splat ;-) No probs. However, the renaming portion is still a rather relative manual affair. Without touching on the content files, I need to re-assign all posts from WS-* to WS-Splat one-by-one manually.
Maybe this could be a new improved feature in 1.8 ? ;-)
Thanks a lot, Scott