tags:

views:

91

answers:

3

This website http://www.donateblood.com.au does not accept the pipe character | in the URL

This works http://www.donateblood.com.au/news-events.aspx?IDDataTreeMenu=33

but this doesn't

http://www.donateblood.com.au/news-events.aspx?IDDataTreeMenu=33&y=|

It looks like the pipe is an issue as

http://www.donateblood.com.au/news-events.aspx?IDDataTreeMenu=33&y=

works.

I need to stop this because a third party called Omniture needs to access this website automatically with the | in the URL. I cannot ask them to encode the | as they are a big company. They say there is some way to allow the | but I am not sure how.

I only have access to web.config, not the server, as it is hosted on a shared server at a big hosting company.

Answer:

Infact, it was our own code blocking the pipe | Very hard to track down, but that was it. This could have been more easily found by searching for the page name where redirection was occurring.

How embarassing!

+1  A: 

pipe characters (and many others!) are not permitted by the URL standard; see http://www.faqs.org/rfcs/rfc1738.html

if they know of a way to make it work, they should be happy to tell you!

Steven A. Lowe
No, you're wrong. They are permitted, they are just named as 'unsafe' and must be encoded. They are allowed though. But it will probably be fairly difficult to get a real resource on any system named `|`; you'll need to handle that type of URL specifically.
Noon Silk
@silky: see section 2.1 of RFC1738; pipe characters (and many others) are not allowed in URLs. Yes, encoding them is the only option.
Steven A. Lowe
+1  A: 

The pipe character should be allow in the URL.

Somehow, your code or some underlying system is acting differently, when it notices the pipe. Find what that system is, and stop it.

-- Edit:

FWIW, I suspect it's some sort of underlying logging system that wishes to check for characters it considers "invalid". Check what type of services are installed, and figure out how to reconfigure them (and what result this will have for the overall security/etc).

AFAIK, it's not a default behaviour of ASP.NET or IIS to reject this type of character.

Noon Silk
+1  A: 

Infact, it was our own code blocking the pipe | Very hard to track down, but that was it.

How embarassing!

Petras