Question

I have an mvc app that has a catch all route setup that occasionally throws a dangerous request path exception on ‘?’.

I have the route setup like

routes.MapRoute(
  "ImageResponse", // Route name
  "{*_*}", // Just cute
  new { controller = "ImageResponse", action = "RenderImage" } // Parameter defaults
);

I get exceptions on paths saying that ‘?’ was a dangerous request, but I can’t reproduce it (copy and paste it straight out of event logs). This seems to happen when I put a bit of load on the machine.

For example, I found something like this in my event logs (everything left of the .jpg has been change to protect the innocent, although there are three dirs and a file name).

/an/example/path/image.jpg?Size=Thumb

Has anyone run into this issue before? It seems like something isn’t detecting my filename there.

Answer 1

are you’re certain there’s no special characters in the actual path? you’re not URL encoding the ? are you? this would cause it to be interpreted as part of the path rather than the beginning of the querystring.

More info/examples here:

Why is using a URL containing a questionmark when redirecting gets a “potentially dangerous request”?

A potentially dangerous Request.Path value…. contains only alphanumerics and an underscore?