vb.net 获取“从客户端检测到潜在危险的 Request.Path 值 (&)”

Getting “A potentially dangerous Request.Path value was detected from the client (&)”

提问by sbarnby71

I have a REST Service and when I try and make a call to an item that has a &in it's name, I get the above error, which would make sense if I was not encoded the &

我有一个 REST 服务，当我尝试调用名称中带有&的项目时，我收到上述错误，如果我没有对& 进行编码，这将是有道理的

So this would be my call:

所以这就是我的呼吁：

http://localhost:57851/myService/Servers/myServer/Repositories/myRepository/Models/Mine%26Yours

http://localhost:57851/myService/Servers/myServer/Repositories/myRepository/Models/Mine%26Yours

You can see "Mine&Yours" has been encoded as "Mine%26Yours" so should be safe.

您可以看到“Mine&Yours”已被编码为“Mine%26Yours”，因此应该是安全的。

But the request is being picked up as though I'd not encoded it.

但是请求正在被接收，就好像我没有对其进行编码一样。

Any ideas?

有任何想法吗？

Edit:

编辑：

This is not the same as (Getting "A potentially dangerous Request.Path value was detected from the client (&)")

这与 (获取“从客户端 (&) 检测到潜在危险的 Request.Path 值”) 不同

回答by holdenmcgrohen

It makes no difference to ASP.NET whether you encode the &symbol or not. See this answer: https://stackoverflow.com/a/12037000/134761

是否对&符号进行编码对 ASP.NET 没有任何区别。看到这个答案：https: //stackoverflow.com/a/12037000/134761

To allow special characters in your URL path you should modify the requestPathInvalidCharactersparameter in web.configlike this:

要在 URL 路径中允许特殊字符，您应该像这样修改requestPathInvalidCharacters参数web.config：

<httpRuntime requestPathInvalidCharacters="" />

Or if you want to only allow &but disallow all other special chars:

或者，如果您只想允许&但禁止所有其他特殊字符：

<httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,\"/>

回答by Matthew Lock

Expanding on holdenmcgrohen answer you can limit the changes just to a particular path if you wish

扩展 Holdenmcgrohen 的答案，您可以根据需要将更改限制在特定路径上

  <location path="documents">
    <system.web>
    <httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,\"/>
    </system.web>
  </location>