我有一个应用程序应该接受来自 Salesforce 的不安全字符。它们是 %0A 和 %0D（到目前为止......）并且它们不起作用。
我已将 allowDoubleEscaping 设置为 true，将 requestValidationMode 设置为 2.0，将 requestPathInvalidCharacters 设置为 < code>BLANK、relaxedUrlToFileSystemMapping 为 true 和 maxRequestLength 为1024。
它不起作用。然后，我尝试为 400 设置自定义错误以重定向到同一页面，而不向其传递 Salesforce 发送的数据。也没起作用。
然后我尝试通过 IIS 7 错误页面部分执行相同的操作，但仍然不起作用。
我怎样才能：
- 让应用程序接受字符？
- 或者让app/IIS重定向到同一页面进行手动输入？
所有这些都在 ASP.NET MVC 3 应用程序中，但我怀疑这是否重要，因为它可能在调用 ASP.NET 运行时之前就被 IIS 阻止了。
我会很感激一些帮助。提前致谢！
I have an application that was supposed to accept unsafe characters from Salesforce. They are %0A and %0D (so far...) and they're not working.
I've set allowDoubleEscaping to true, requestValidationMode to 2.0, requestPathInvalidCharacters to BLANK, relaxedUrlToFileSystemMapping to true and maxRequestLength to 1024.
It didn't work. Then I tried setting a custom error for 400 to redirect to the same page without passing it the data Salesforce was sending. Also didn't work.
Then I tried doing the same through the IIS 7 Error Pages section and it still didn't work.
How can I:
- Get the app to accept the characters?
- Or get the app/IIS to redirect to the same page for manual entry?
All of this is in an ASP.NET MVC 3 application, but I doubt that matters because its probably IIS stopping it before it even calls the ASP.NET runtime.
I'd appreciate some help. Thanks in advance!
发布评论
评论（3）
您可能想要查看的位置是在 IIS 管理器中，单击您的服务器节点（或网站节点），然后找到“请求过滤”图标。转到
URL选项卡，您可以在此处始终允许特定 URL，或更改一般处理 URL 过滤的方式。我确信这些设置也可以在 web.config 文件的部分下使用，但我不知道所有设置元素和属性是什么（我确信您可以进行搜索并轻松找到它们）。修复此问题后，您可能还必须与 ASP.NET 作斗争。
Where you probably want to look is in the IIS Manager, click on your server node (or website node), an find the
Request Filteringicon. Go to theURLtab and here you can either allow specific URL's always, or change the way URL filtering is handled in general. I'm sure these setting are also avaialble under the section of the web.config file, but I dont know off hand what all the settings elements and attributes would be (I'm sure you could do a search and find them easily).You may have to fight past ASP.NET after you fix this as well.
检查您的 URLScan 配置。
http://learn.iis.net/page.aspx/476/ common-urlscan-scenarios/
您是否碰巧在您的 [DenyUrlSequences] 部分中列出了此内容？
Check your URLScan config.
http://learn.iis.net/page.aspx/476/common-urlscan-scenarios/
Do you happen to have this listed in your [DenyUrlSequences] section?
也许有点太晚了，但对我来说，它通过使用AllowRestrictedChars注册表设置更改配置的异常来工作（如https://support.microsoft.com/en-us/kb/820129）。默认值是 0，我将其更改为 1。如果非零，Http.sys 接受请求 URL 中的十六进制转义字符，这些字符解码为 U+0000 – U+001F 和 U+007F – U+009F 范围。
Maybe it's a little too late but for me it worked by changing the configured exceptions using the AllowRestrictedChars registry setting ( as documented in https://support.microsoft.com/en-us/kb/820129). The default value is 0, I changed it to 1. If nonzero, Http.sys accepts hex-escaped chars in request URLs that decode to U+0000 – U+001F and U+007F – U+009F ranges.