500内部服务器错误IIS7编码的URL

Question

Im using N2Cms and am looking in to some issues i have with it. It has a navigation panel on the left hand side that loads via ajax as you expand the tree.

The code that gets the childeren of the node calls an ashx file with some parameters. One parameter is for a path and contains slashes in it. For this reason it has been encoded.

.../cms/Content/Navigation/LoadTree.ashx?target=preview&selected=%252fhome%252fhelp-and-advice%252f

I have had no issues with this on my development server (running iis 7.5) but when deployed to our test server (iis7) the navigation fails to work.

Investigating this has shown that the above url gives a 500 error.

If i decode the url to

.../cms/Content/Navigation/LoadTree.ashx?target=preview&selected=/home/help-and-advice/

it works with no problems.

Unfortunately i cannot change the code that generates this as its a part of the n2cms source code and i am assuming it has been encoded for a good reason.

Does anyone know anything i can do either in my web.config to allow encoded parameters or something i can change on the iis server?

EDIT: So this link seems to suggest that its doing this on purpose as a security mesure. http://msdn.microsoft.com/en-us/library/ee656542.aspx

The suggested solution is to upgrade to .net 4.0 and add the following to the web.config

<configuration>
 <uri>
   <schemeSettings>
    <add name="http" genericUriParserOptions="DontUnescapePathDotsAndSlashes"/>
   </schemeSettings>
 </uri>
</configuration>

Unfortunately this seems to have no effect.

Any Ideas why this doesnt work?

Answer 1

This could be the URLScan utility. URL Scan blocks URL's based on the rules in it's config file. It also has it's own log file, so you can tell for sure by looking at the URLScan log.

Do a google search for URLSCan default location.

Answer 2

It seems your url goes through 2 html encode. Is there some url rewriting module active on your IIS7 server ?

Answer 3

OK, im getting somewhere with this.

When trying to find the error in the IIS logs and failing, then looking through many posts about failed tracing request and still not getting any errors in iis, i figured that the request was just not getting to IIS.

Looking back at the server error, there was a clue there too.
500 Internal Server Error. The request was rejected by the HTTP filter.

It is the firewall!! We have disabled the HTTP Filter and now it works :)

I now need to investigate what this HTTP Filter was supposed to be protecting us against and are we secure now we have switched it off.