渲染输出中缺少HTML块

Question

我管理一个.NET webforms网站,自从我在这里工作之前就遇到了一个奇怪的问题.每隔一段时间就会抛出一个 System.Web.HttpException:从客户端(:)错误电子邮件中检测到一个潜在危险的Request.Path值.

该错误来自网站中随机页面的随机部分,而我注意到的最后一个部分是针对CGI script_name的此条目:

SCRIPT_NAME /Scrienu_6 { border-style:none; }.SystemMenu_7 { background-color:

Looking at the rendered code for the page, it looks like a packet has been dropped near the head of the response and it's slicing off the end of the src portion of a script tag down to partway through an inline style block.

<script type="text/javascript" src="../Scripts/DisableTheScreen.js"></script>
<style type="text/css">
.floatingMenu
{
margin-top: 0px;
}
</style>
<link href="../App_Themes/siteTheme/Button.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/ConfirmBox.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/DisableBox.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/Panel.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/ResizableTextBox.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/Site.css" type="text/css" rel="stylesheet" />
<link href="../App_Themes/siteTheme/Tabs.css" type="text/css" rel="stylesheet" />
<style type="text/css">
.SystemMenu_0 { background-   color:white;visibility:hidden;display:none;position:absolute;left:0px;top:0px; }
.SystemMenu_1 { color:White;font-weight:bold;text-decoration:none; }
.SystemMenu_2 { color:White;font-weight:bold; }
.SystemMenu_3 { }
.SystemMenu_4 { background-color:#004A80; }
.SystemMenu_5 { background-color:#004A80; }
.SystemMenu_6 { border-style:none; }
.SystemMenu_7 { background-color:#004A80; } 

So that it winds up slicing a chnk out of the middle eg:

<script type="text/javascript" src="../Scri

enu_6 { border-style:none; }
.SystemMenu_7 { background-color:#004A80; } 

I've seen packet drops do fun things with images and unloaded CSS files in the past, but I've never seen them carve bits out of the rendered page content. I've googled the issue quite a bit but have not found anything similar so not sure if I'm even looking for the right problem.

The issue has only fired 22 times in the last 5 months on a fairly high-use system, but it's probably happening more frequently than that since we only see an error if a call back to the server has been borked with characters deemed unsafe by the request validator.

So yeah, just wondering if anyone has any ideas about what I can do or look for to solve this? :)

This behavior was observed in IIS7/Win2k8. It has also reportedly been observed in IIS8/Win2k12 and IIS8/Win8.1. I have seen no evidence of this in IIS6/Win2k3. It was last reported by two different customers of mine around November 2013. Neither of the server environments had VisualStudio installed. .NET Framework 2.0, 3.5, and 4.5[1?] were installed in both server enviros.

I have requested logs and full specs from both customers, and one of them has responded and confirmed that the issue no longer occurs. Therefore I suspect that either an update or hotfix from Msft addressed it, that it was network-related and has been resolved, or that Cthulhu decided to torment somebody else. The other customer has not yet responded.

当然除了OP以外的其他人和这些客户一定见过这种行为吗？如果可能的话,找到明确的答案并将此问题与已知修复相关联将会很不错.(你得到一个甜蜜的200分......耶!)

Answer 1

你的请求url中是否有*，这可能会导致这样的情况。

**

<system.web>
    <httpRuntime requestPathInvalidCharacters="&lt;,&gt;,%,&amp;,:,\,?" />
</system.web>

**

您可以将其添加到您的网络配置中以使其正确