Asp.Net MVC Core enabling double escape

Question

I am working on a asp.net mvc core application and trying to allow double escaping.

My Edit url has a phone number as hyperlink (Ex: +123). I know how to do with a normal asp.net mvc application. I used to change web.config file as

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="true"/>
    </security>
</system.webServer>

But I am right now on Asp.Net MVC Core application with out a web.config. How and where can I manage this?

This looks very, very similar, can you try this and update the question: stackoverflow.com/a/42846612/495455 — Jeremy Thompson
– Jeremy Thompson, Commented Apr 5, 2018 at 5:33

CodeFuller · Accepted Answer · 2018-04-05 20:44:26Z

6

ASP.NET Core application could be hosted on variety of web servers (IIS, Kestrel, Nginx, Apache, ...). All these web servers know nothing about request filtering (and particularly enabling of double escape) which is a native IIS feature. It's a hosting concern and ASP.NET Core application should not deal with it directly. If URL like http://youserver.com/Home/Phone/+12345 will reach ASP.NET Core pipeline, plus sign will not be treated in any special way and will get to string model as + character.

When you host your application on IIS, web.config is still in use, so you could configure <requestFiltering allowDoubleEscaping="true"/> as for usual ASP.NET application. Again, you should not be afraid that you do something in non ASP.NET Core way. You configure a hosting concern; it's not the field of ASP.NET Core.

If you want to host application in another Web server, you should check how it handle special characters. I know that Kestrel will just pass such URLs as is, so you don't need to take any specific actions if hosted on Kestrel.

edited Apr 5, 2018 at 20:44

answered Apr 5, 2018 at 18:27

CodeFuller

31.4k3 gold badges72 silver badges90 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

CodeFuller Over a year ago

@Kurkula, I have revised my answer in part of non-IIS hosting. I have overcomplicated it at first. After considering it a bit, I realized that no custom middleware is actually required.

DeveloperDan Over a year ago

To allowDoubleEscaping during development with IIS Express here's what I did: stackoverflow.com/q/56463044/381082

Simon_Weaver · Accepted Answer · 2020-02-28 19:16:10Z

You should use the web.config transformations - or you'll wipe it out next time you deploy and your customer will come back and say 'hey it broke again!'

Create a web.Release.config file (you don't need a web.config file in your actual project) with the following:

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <location>
    <system.webServer>

      <security xdt:Transform="InsertIfMissing">
        <requestFiltering allowDoubleEscaping="true" />
      </security>

    </system.webServer>
  </location>
</configuration>

When you publish a release build this will get added - as well as all of the aspNetCore handlers. Very important to include the part InsertIfMissing or it will be ignored.

You DON'T need a third party package such as this. 7

Collectives™ on Stack Overflow

Asp.Net MVC Core enabling double escape

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related