URLScan 和百分号
所以我遇到了一个愚蠢的问题，用户无法下载带有百分号的文件。这是一个IIS6/Win2k3盒子。它最终成为 URLScan。我必须在 urlscan.ini 中取消设置两件事：
1) 将VerifyNormalization 设置为0（禁用）
2) 删除“DenyUrlSequences”部分的百分号
执行 iisreset，问题解决。但最大的问题是：这有多大的安全风险？
So I just ran into a stupid problem in which users could not download files that had a percent sign in it. This is an IIS6/Win2k3 box. It wound up being URLScan. I had to un-set two things in urlscan.ini:
1) Set VerifyNormalization to 0 (disabled)
2) Remove the percent sign from the "DenyUrlSequences" section
Do an iisreset, and problem solved. But the big question is: How much of a security risk is this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
百分号用于 URL 编码，可用于表达讨厌的字符，例如引号。这种拒绝可能是由于 NormalizeUrlBeforeScan 打开或关闭所致，我会尝试翻转此设置。
UrlScan 不是一个非常好的 WAF，您可能会遇到其他误报/误报问题。 Mod_Security 更成熟，可以与 IIS 一起使用，但它涉及运行反向代理，老实说这有点混乱，但恕我直言，它比 UrlScan 更混乱。
如果您有一些备用金砖，您应该拿起 Cisco ACE，是一个不错的WAF。
Percent signs are used in URL encoding and could be used to express nasty chars such as Quote Marks. This rejection may be due to NormalizeUrlBeforeScan being on or off, I would try flipping this setting.
UrlScan isn't a very good WAF and its likely that you will run into problems with other false positives/false negatives. Mod_Security is more mature and can be used with IIS however it involves running a reverse proxy which to be honest is a bit of mess but IMHO its a better mess than UrlScan.
If you have some spare gold bricks you should pick up Cisco ACE, it is a good WAF.
处理未过滤的 URI 字符实体时要小心，因为 URI 字符串可用作代码注入的工具。
Be careful with processing of unfiltered URI character entities as URI strings can be used as vehicles for code injection.