special characters in url give "Bad Request" or "Illegal characters in path"

Question

I'm using javascript to request a image generated by the server in real time.

The parameter is passed in the url and grabbed by MVC, and set in the "id" parameter to the controller. Like this:

Public Function Index(ByVal id As String) As ActionResult

This works fine if i dont use any special characters, like "?" or quotes. To send those I have to escape or encode this content, but how should i do it?

I tried javascript escape or encodeURIComponent, but it either gives me "bad request" or "Illegal characters in path"

A sample url would be http://localhost/Imagem/Index/Question%3F, for "Question?"

This returns "Bad request"

Answer 1

You are trying to access a image file created by sever at run time.

In above question you are trying to access a image file as Questions?

Image file or any file is not going to have any special chracter included in name so I think it's very obvious error - - illegal characters in path.

Answer 2

You may find this blog post useful. As you will see there are workarounds but use at your own risk. Add this to your web.config if you are using .NET 4.0:

<system.web>
    <httpRuntime 
        requestValidationMode="2.0"
        requestPathInvalidCharacters="&lt;,&gt;,*,%,:,&amp;,\"
        relaxedUrlToFileSystemMapping="true"
    />
    ...
</system.web>

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="true" />
    </security>
    ...
</system.webServer>

Personally I would recommend you avoid using special characters in an url like this. You could either transform them into some other character using a mapping function or use them only in a query string parameter: http://localhost/Imagem/Index?id=Question%3F

Answer 3

Thanks for the replies but i worked this around by using escape and then converting the % characters to something i would later in my server code change back to % and unescape myself.

In the client script:

myImg.src = "../../Imagem/Index/" + escape(myValue).replace(/\%/g, "_-_");

In the controller:

Public Function Index(ByVal id As String) As ActionResult
    id = id.Replace("_-_", "%")
    id = HttpUtility.UrlDecode(id, System.Text.Encoding.Default())
    Return New ImageResult(CreateImage(id))
End Function