Our application security certification program raised a security issue on our Sitecore Staging and Live environment.
"Any URL where folder or file name ends with Space or Dot gives 404 - The resource cannot be found error."
For example, accessing URLs like
- http://sitecore72/sitecore%20/login
or
- http://sitecore72/sitecore./login
Both gives below error. Same, if we do same kind of request on any live site, it gives same error like for URL: http://sitecore/CMS /Sitecore/
After reading more on net, found below setting. The value of relaxedUrlToFileSystemMapping attribute should be true to solve this issue, by default its value is false in ASP.NET and Sitecore:
If this property is false, the URL is validated by using the same rules that determine whether a Windows file system path is valid.
If it is true, it will not validate any folder or file name.
Note: Later on we found that Sitecore has solved this bug from Sitecore 7.2 Update-2 by changing same attribute, they have not mentioned this bugfix in their release notes.
For example, accessing URLs like
- http://sitecore72/sitecore%20/login
or
- http://sitecore72/sitecore./login
Both gives below error. Same, if we do same kind of request on any live site, it gives same error like for URL: http://sitecore/CMS /Sitecore/
Tricks we already applied, what failed:
- Tried to catch this error from Application_Error event from Global.asax, but no luck found.
- We also tried to handle it from web.config using CustomErrors, but again no luck.
Solution we found at last:
After checking many ASP.NET sites, including Microsoft website, this issue was found on majority of sites. For example, http://www.microsoft.com/security /default.aspx, it gives same error. So finally we concluded that this bug is not from Sitecore side, but it's something what .NET is playing with.After reading more on net, found below setting. The value of relaxedUrlToFileSystemMapping attribute should be true to solve this issue, by default its value is false in ASP.NET and Sitecore:
<httpruntime relaxedurltofilesystemmapping="true" />Now, after applying this fix, the above URL on Staging environment sends user to NotFound error page and on live environment, it opens a valid page by ignoring Dot or Space.
What relaxedUrlToFileSystemMapping attribute does?
It indicates whether the URL in an HTTP request is required to be a valid Windows file path. It determines how the URL in an incoming HTTP request will be validated.If this property is false, the URL is validated by using the same rules that determine whether a Windows file system path is valid.
If it is true, it will not validate any folder or file name.
Note: Later on we found that Sitecore has solved this bug from Sitecore 7.2 Update-2 by changing same attribute, they have not mentioned this bugfix in their release notes.