1

sorry for my english

I have a problem with c1 installed on iis 7.5

For example:

I want to edit the input parameters: Function/XSLT Function/ When you push the combo [Default value] or [Test value] dialog does not display

error in console: Failed to load resource: the server responded with a status of 404 (Not Found)

http://[domain]/Composite/content/dialogs/functions/editFunctionCall.aspx?type=System.String&dialoglabel=Parameter+Default+Value&multimode=false&functionmarkup=%3Cf:function%20xmlns:f=%22http://www.composite.net/ns/function/1.0%22%20name=%22Composite.Constant.String%22%20/%3E

error in site log:

HttpRequestValidationException

url: http://[domain]/rejected-by-urlscan?~/composite/content/dialogs/functions/editfunctioncall.aspx?type=system.string&dialoglabel=parameter default value&multimode=false&functionmarkup=

path to file: at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) at System.Web.HttpRequest.get_RawUrl() at Composite.Core.WebClient.WC

error: A potentially dangerous Request.RawUrl value was detected from the client (="...ionmarkup=

System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) at

System.Web.HttpRequest.get_RawUrl() at Composite.Core.WebClient.WCF.MultipleHostnameHandler.OnBeginRequest(Object sender, EventArgs e) at

System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at

System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

changes to the file web.config

validateRequest="false" requestValidationMode="2.0"

etc... are unsuccessful :(

Plis help :)

1 Answers1

0

For some reason the web server you're using is converting the query strings like:

...&functionmarkup=%3f:...

into

...&functionmarkup=<f:...

which is, by ASP.NET, considered to be a potential XSS attack.

There doesn't seem to be a way to change the behavior via configuration files. We're currently working on a patch for Composite C1 3.2 that will address this issue

Pauli Østerø
  • 6,878
  • 2
  • 31
  • 48
Dmitry Dzygin
  • 1,258
  • 13
  • 26