Geek asks and answers

Deny query parameters for specific files in IIS 7.5 or .NET.

Is there a general way to reject request parameters in files .swfin IIS 7 or using .Net?

We have an application with a small batch SWF file that allows XSS by invoking it with specific query string parameters. Therefore, we want to disable the parameters in a general way.

The only thing that comes to my mind is to write a handler that redirects a file call to a call without parameters.

+5
source share
2 answers

You do not need Handler, just a new IIS rule Rewritethat will conform yourfile.swf?*and rewrite it as yourfile.swf(explicitly without adding querystring).

Something like (not tested):

<configuration>
<system.webServer>
    <rewrite>
        <rules>
            <rule name="strip_querystring" patternSyntax="Wildcard" stopProcessing="true">
                <match url="yourfile.swf*" />
                <action type="Rewrite" url="yourfile.swf" appendQueryString="false" />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

+2

Global.asax BeginRequest

 Private Sub Global_BeginRequest(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.BeginRequest

        Dim httpContext As HttpContext = httpContext.Current
        Dim request As HttpRequest = httpContext.Request
        Dim response As HttpResponse = httpContext.Response

        If request.QueryString.Count > 0 AndAlso request.Url.LocalPath.EndsWith(".swf", StringComparison.InvariantCultureIgnoreCase) = True Then
            response.Redirect(request.Url.LocalPath)
        End If


    End Sub
0

More articles:


All Articles