How may i escape / and other characters in asp.net?

Question

When i visit http://localhost:17357/u/a%2fa/m/ssd-10 and look at HttpContext.Current.Request.Url in Application_BeginRequest i see http://localhost:17357/u/a/a/m/ssd-10 huh? shouldnt i get http://localhost:17357/u/a%2fa/m/ssd-10? i thought the point of escaping urls is so ?, &, / and other special symbols not be confused with their special meaning in urls. Maybe theres a config i need to tweak?

---

I created 4 usernames, there are

a?@!&ee
a?@!/&ee
as d
ｸｲﾝ

with the links as

<a href="/u/a%3f%40%21%26ee">a?@!&amp;ee</a><br>
<a href="/u/a%3f%40%21%2f%26ee">a?@!/&amp;ee</a><br>
<a href="/u/as%20d">as d</a><br>
<a href="/u/%ef%bd%b8%ef%bd%b2%ef%be%9d">ｸｲﾝ</a>

The last two work, but the first two i get the exceptio

A first chance exception of type 'System.ArgumentException' occurred in mscorlib.dll

Additional information: Illegal characters in path.

then

A first chance exception of type 'System.Web.HttpException' occurred in System.Web.dll

Additional information: '/u/a?@!&ee' is not a valid virtual path.

and my page says Bad Request. How can i allow these usernames to work. If its impossible how can i write a workaround?

Answer 1

You need to escape it again. Use %252f instead of %2f. To clarify, the URL is unencoded when the server receives it. URL encoding allows you to pass in a / that the server processes as a character instead of the special function that a reserved character would normally trigger. See the Wikipedia page for more info.

Concerning your error with the a?@!&ee username, it seems almost certain that you're running into a problem that ASP.NET has with special characters (even urlencoded properly) that are not in the query string (that is, after the ? part of the URL). Joshua Flanagan talks about it in a blog post, and identifies %, &, *, and : as the problematic characters.

He points to a Dirk.Net blog post that offers a couple of fixes. First, you can edit the registry to allow restricted characters (adding a DWORD key AllowRestrictedChars to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters and setting its boolean value to true). Or, you can ensure that you have the .NET framework 1.1 SP1 and edit the registry to set ASP.NET VErification Compatibility to true (DWORD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET VerificationCompatibility = 1). Third, you can try setting ValidateRequest to false on the ASPX page. Finally, as Joshua decided to do, you can pass the information using the query string, i.e. after the ? as ASP.Net originally (pre MVC) expected.

Answer 2

I wrote my own solution. Its nice to have a username with / but not consider as / when getting a GET request.