Help with ASP.Net error: "Cannot use a leading .. to exit above the top directory"

Question

I'm seeing this error several times an hour on my production site and am not quite sure how to fix it. I've grepped the source code and I am not using "../" anywhere in my code to generate a path.

My application is running on IIS6 on Win2003 Server. It's using URLRewriter.Net to allow the site to have friendly URLs, and I'm wondering if this could be contributing to the problem.

I've already Googled for a solution and have found several possibilities but none have worked for me.

I've tried creating a new App_Browser file to force the tagwriter settings to use a specific HtmlTextWriter, as suggested in one of the most popular solutions, but that hasn't worked for me. I haven't seen any other likely solutions.

Thanks in advance for your help.

Answer 1

Use reflector to dig into the URLRewriter.Net code.

Answer 2

It's probably due to using "~/something", probably on a Hyperlink control. When the physical file is at a different directory level from the friendly URL, ASP.NET uses too many ../'s in the relative URL that it generates, giving this error. If you can't just use an absolute URL instead, I believe that you can use Page.ResolveUrl("~/foo/bar") to get the proper relative URL.

Answer 3

I would give your rewrite paths another once through and see if maybe there is a path that contains a folder that either doesn't exist, has been flubbed or is in fact outside the web application. Can you post the rewrite rule here?

Answer 4

Are you sure that you are causing the error?. Some scripts (Code Red/Nimda) troll the internet looking for a URL traversal that looks like that error.

Is this internal or external? Is it possible that your machine is getting scanned?

Answer 5

I was able to resolve this issue by installing .NET 3.5 SP1.

Answer 6

Just set the Enable Parent Paths to True in the ASP settings from your website

That solved the problem for me