0

If you run UrlScan on IIS with the default settings (no changes to UrlScan.ini), the HTTP GETs fail for the swf files in ~/fbsite/flash_graph.

The url that the page tries to load: ~/fbsite/flash_graph/graph.swf?sNoFlash7=%3cfont+face%3D%27Verdana%2CArial%2CHelvetica%2Csans%2Dserif%27+size%3D%2714%27%3E%3Cfont+size%3D%2716%27%3E%3Cb%3EUpdate+Your+Flash+Player+Version%3C%2Fb%3E%3C%2Ffont%3E%3Cbr%3E%3Cbr%3EThis+content+requires+Adobe+Flash+Player+version+7%2E++FogBugz+has+detected+that+you+have+a+version+older+than+this%2E++Please+download+the+latest+Flash+Player%2C+available+at+%3Cfont+color%3D%27%230000FF%27%3E%3Cu%3E%3Ca+href%3D%22http%3A%2F%2Fwww%2Eadobe%2Ecom%2Fgo%2Fgetflashplayer%22+target%3D%22%5Fblank%22%3Ehttp%3A%2F%2Fwww%2Eadobe%2Ecom%2Fgo%2Fgetflashplayer%3C%2Fa%3E%3C%2Fu%3E%3C%2Ffont%3E%2E%3Cbr%3E%3Cbr%3E%3Cfont+size%3D%2710%27+color%3D%27%23999999%27%3EAdobe+and+Flash+are+trademarks+of+Adobe+Systems+Incorporated%2E%3C%2Ffont%3E%3C%2Ffont%3E

And the IIS log entry logged by UrlScan: 2011-04-13 23:04:52 W3SVC1 172.21.115.4 GET /Rejected-By-UrlScan ~/fbsite/flash_graph/graph.swf?sNoFlash7=%3cfont+face%3D%27Verdana%2CArial%2CHelvetica%2Csans%2Dserif%27+size%3D%2714%27%3E%3Cfont+size%3D%2716%27%3E%3Cb%3EUpdate+Your+Flash+Player+Version%3C%2Fb%3E%3C%2Ffont%3E%3Cbr%3E%3Cbr%3EThis+content+requires+Adobe+Flash+Player+version+7%2E++FogBugz+has+detected+that+you+have+a+version+older+than+this%2E++Please+download+the+latest+Flash+Player%2C+available+at+%3Cfont+color%3D%27%230000FF%27%3E%3Cu%3E%3Ca+href%3D%22http%3A%2F%2Fwww%2Eadobe%2Ecom%2Fgo%2Fgetflashplayer%22+target%3D%22%5Fblank%22%3Ehttp%3A%2F%2Fwww%2Eadobe%2Ecom%2Fgo%2Fgetflashplayer%3C%2Fa%3E%3C%2Fu%3E%3C%2Ffont%3E%2E%3Cbr%3E%3Cbr%3E%3Cfont+size%3D%2710%27+color%3D%27%23999999%27%3EAdobe+and+Flash+are+trademarks+of+Adobe+Systems+Incorporated%2E%3C%2Ffont%3E%3C%2Ffont%3E 80 - 172.21.115.145 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US)+AppleWebKit/534.16+(KHTML,+like+Gecko)+Chrome/10.0.648.204+Safari/534.16 http://mapping.cbre.com/fb/default.asp?pg=pgProjectHomepage&ixProject=42&ixFixFor=26&ixPriority=7&nGraphType=4 404 0 2 1795 3144 0

It doesn't say which rule the url violated in the log. I would toy around with my UrlScan.ini until I found the setting that blocks it, but changes to UrlScan.ini require and IIS reset, and this is on a production web server, so I don't have that luxury.

flag

closed as too localized by Rich Armstrong♦♦ Sep 20 2011 at 20:39

1 Answer

0

It's likely that it's running afoul of a double-encoding prohibition. Double-encoding is used infrequently by phishing emails to mask the URL you're actually looking at, but it's so frequently blocked, that it's little used. So it's fairly safe to allow double-encoding.

link|flag
I'm fairly certain that it's not the double encoding, because we use that on the same servers that have UrlScan installed. It's the < and > characters, since the url has raw unencoded html in it. – unknown (google) Apr 28 2011 at 6:46
Okay. The query string is pretty much only for when there's no Flash on the machine. Is there a way to ignore the query string for this request entirely? – Rich Armstrong♦ Apr 28 2011 at 13:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.