为什么使用包含冒号的 URL 被视为“潜在危险的请求”？
有人（可能是机器人）向我的 ASP.NET 4.0 Web 表单应用程序（在 IIS 7.0 上运行）发送了包含以下 URL 的请求：
http://ipaddress-of-my-applications-domain/bla1.bla2。 bla3.bla4.bla5:)
这导致了 System.Web.HttpException。我收到了来自我配置的 ASP.NET HealthMonitoring 的日志记录电子邮件，告诉我：
从客户端检测到潜在危险的 Request.Path 值 (:)。
堆栈跟踪是：
System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Why is a colon in the URL“有潜在危险”？使用这样的 URL 可以做哪些危险的事情？这里是否存在我不知道的安全漏洞？
感谢您提前解释！
编辑
我已经测试过查询字符串中的冒号（例如http://mydomain.com?Test=9:)）不会导致此异常。
Someone (probably a bot) sent a request with the following URL to my ASP.NET 4.0 web forms application (running on IIS 7.0):
http://ipaddress-of-my-applications-domain/bla1.bla2.bla3.bla4.bla5:)
This caused an System.Web.HttpException. I received a logging email from ASP.NET HealthMonitoring I had configured, telling me:
A potentially dangerous Request.Path value was detected from the client (:).
Stack trace was:
System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
System.Web.HttpApplication.PipelineStepManager.ValidateHelper(HttpContext context)
Why is a colon in the URL "potentially dangerous"? What dangerous things can be done with such a URL? Do I have any security hole here I am not aware of?
Thanks for explanation in advance!
Edit
I've tested that a colon in a query string (like http://mydomain.com?Test=9:)) does not cause this exception.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
在 NTFS 上，给定的文件路径可以有多个关联的数据流。除了主流（也称为
$DATA）之外，还可以有其他流，通常用于存储元数据，例如下载文件中的 Internet 区域标记。备用数据流使用冒号分隔符进行访问，例如。
file.dat:$DATA是file.dat的另一种表达方式。通过网络出现的 ADS 过去曾给 Microsoft 带来过一些安全问题（例如，返回 ASP 页面的源代码而不是执行它们），因此作为预防措施，他们阻止在 ASP 页面的路径部分中使用冒号。 URL，因为路径部分通常映射到文件系统（尽管不是在您的情况下）。这种情况在查询字符串中不太可能发生，因此不会被阻止。这远非请求验证所产生的最严重的误报。其防注入功能就差很多了。我个人总是会禁用它，因为它是一个愚蠢的损坏功能，永远无法真正确保您的网络应用程序的安全；只有适当注意字符串转义（以及对您计划用作文件名的任何内容进行严格清理）才能做到这一点。
还有其他字符，即使您关闭请求验证，也无法将其放入路径部分中以用于路由目的。特别是斜杠（
%2F、%5C以及解析为相同内容的超长 UTF-8 序列无效的字节序列）和零字节。一般来说，最好对路径中的内容保持保守。On NTFS, a given filepath can have multiple associated data streams. Apart from the main stream, also known as
$DATA, there can be others, typically used to store metadata like the Internet Zone marker in downloaded files.Alternate Data Streams are accessed using a colon separator, eg.
file.dat:$DATAis an alternative way of sayingfile.dat. The presense of ADSs through the web has caused Microsoft some security issues in the past (eg. returning the source code of ASP pages instead of executing them), so as a precaution they're blocking the use of colon in the path part of the URL, as the path part often maps to the filesystem (though not in your case). This is less likely to occur from the query string so is not blocked there.This is far from the worst false positive Request Validation will generate. Its anti-injection features are much worse. I personally would always disable it, as it's a stupid broken feature that can never actually make your webapp secure; only proper attention to string-escaping (and heavy sanitisation of anything you plan to use as a filename) can do that.
There are other characters that even if you turn Request Validation off you can't put in a path part for routing purposes. In particular, slashes (
%2F,%5C, and byte sequences that would be invalid overlong UTF-8 sequences resolving to the same) and the zero byte. It's best to be conservative about what you put in paths in general.我不太记得了，但 Internet Explorer 与操作系统绑定，它能够执行一些不好的事情，例如“con:sss”能够打开控制台并执行一些批处理命令等，冒号之前的任何内容都被视为协议并且 Windows 允许您可以覆盖/创建可由您的 dll 打开和使用的新协议。任何对 com 和 url 名称有丰富经验的人都可能会给您非常正确的答案。
I dont recollect exactly, but Internet Explorer is tied to operating system and it was able to perform some bad things like "con:sss" was able to open console and perform some batch commands etc, anything before colon is considered as protocol and windows allows you to override/create new protocols that can be opened and consumed by your dll. Anyone with greater experience of com and url monikers may give you very correct answer.
这是由于 ASP.NET 的请求验证功能可以防止客户端攻击您的网站。该功能默认启用。
以下链接解释得更好： http://www.asp.net/learn/whitepapers/请求验证
This is due to the request validation feature of ASP.NET, which prevents clients from attacking your website. The feature is enabled by default.
The following link explains better: http://www.asp.net/learn/whitepapers/request-validation