Can't read images from C:\ in ASP.NET

Question

I realize this is an edge case, but it seems that asp.net doesn't allow reading images from the root drive. To test this I wrote the following very simple application:

On the page I have:

<asp:Image ID="test" runat="server" />

In the code behind I have:

test.ImageUrl = @"C:\test\image.jpg";
test.AlternateText = File.ReadAllText(@"C:\test\text.txt");

Both files exist as you'd expect and have the correct permissions. When viewing the source of the page we get an img tag that looks like the following:

<img id="test" src="C:\test\image.jpg" alt="some text to read" style="border-width:0px;" /> 

When I run this in VS no image is displayed. If I copy the source, paste it into an html file and load it into a browser the image is displayed. Can anybody explain why this is?

Answer 1

I know that you said the permissions were correct, but double check and make sure the aspnet\aspnet_wp account has permissions to the file location. When you run an asp.net application it runs under this account. When you load an HTML file in your browser, it runs as you.

Answer 2

This is because you're feeding a "URL" into the src tag, and the browser treats it as such. When you open a file such as C:\test.html it is simply rendered by the web broswer and uses the local source as the starting URI, but when you load from another source, such as http://localhost/test.html then the file needs to be accessible through http, and http://C:\test\image.jpg is not a valid URL.

Answer 3

The src of an img tag should rarely point to a file on your local disk. It should be an URI. Perhaps you'll have more success using the file:///C|/test/image.jpg syntax.

Answer 4

Seems to work properly if you use a url. Not sure what the difference there would be though.

Answer 5

It has to do with the way you're assigning the img src. By providing C:\test\image.jpg as the sourc you're instructing the BROWSER to get the image from the user's local drive rather than from the server's location.

All src directories/files should be specified using relative paths for your website. For example: If your homepage was located on your server at c:\www\homepage.aspx and you also had an images sub-directory located within the www directory then you'd want to specify your img src to be something like this: <img src="/images/image.jpg" alt="Image" />

Answer 6

The html code is invalid. It should not render in any browser, VS, firefox, IE or any other. In fact it does not in firefox.

Answer 7

The browser is preventing the images from being displayed. I created a static HTML page containing an tag whose "src" pointed to an image on my local file system. If I open the HTML page locally, everything works as expected. However, when I hosted the static HTML page in a web server, it stopped working.

I ran ProcMon while loading the HTML page from the remote server, and the local file was accessed (some columns truncated for display purposes):

iexplore.exe    6376 QueryDirectory C:\test.jpg SUCCESS test.jpg
iexplore.exe    6376 QueryOpen C:\test.jpg SUCCESS 
iexplore.exe    6376 QueryDirectory C:\test.jpg SUCCESS 
iexplore.exe    6376 CreateFile C:\test.jpg SUCCESS
iexplore.exe    6376 ReadFile C:\test.jpg SUCCESS
iexplore.exe    6376 CloseFile C:\test.jpg SUCCESS

However, IE did not display the image. I repeated the test with Firefox. When accessing locally, the ProcMon results were the same. When accessing remotely, ProcMon didn't produce any output.

Answer 8

This is a browser security "feature". The goal is to prevent malicious websites from accessing your local files, and causing them to either be executed or uploaded to the website without your knowledge.

In order to get past it I believe you will have to change your security zone to "local intranet", then drop the security down to pretty much allow everything.

Obviously this is only viable for machines you directly control.