0

I have uriscan installed on my Win2003 server and it is blocking an older ColdFusion script. The log entry has the following--

2008-09-19 00:16:57 66.82.162.13 1416208729 GET /Admin/Uploads/Mountain/Wolf%2520Creek%2520gazeebo.jpg Rejected URL+is+double+escaped URL - -

How do I get uriscan to allow submissions like this without turning off the double-escaped url feature?

user18010
  • 101
  • 1
  • 2
  • 3

2 Answers2

1

To quote another post on the subject,

some aspect of your process for submitting URIs is doing some bad encoding.

http://www.usenet-forums.com/archive/index.php/t-39111.html

I recommend changing the name of the JPG to not have spaces in it as a good practice, then later try to figure out with a non-production page why you're not interpreting the %20 as an encoded space, but as a percent sign and two digits.

Community
  • 1
  • 1
devinmoore
  • 2,726
  • 3
  • 19
  • 14
0

How do I get uriscan to allow submissions like this without turning off the double-escaped url feature?

How do you get it to allow double-escaped URLs without turning off the double-escaped url feature? I think there's something wrong with what you're trying to do. My question is this: does your HTML source literally show image requests with "%2520" in them? Is that the correct name for your file? If so, you really have only two options: rename the file or turn off the feature disallowing double escapes.

Kevin
  • 5,874
  • 3
  • 28
  • 35