The differences in how the SF_REQ_NORMALIZE_URL server support function and Http.sys in Internet Information Services 6.0 normalize a URL (896287)


The information in this article applies to:

  • Microsoft Internet Information Services version 6.0

INTRODUCTION

This article describes the differences in how the SF_REQ_NORMALIZE_URL server support function and Http.sys in Microsoft Internet Information Services (IIS) 6.0 normalize a URL.

Normalization includes decoding hexadecimal codes, removing characters that are not valid, and performing some international conversions.

MORE INFORMATION

The SF_REQ_NORMALIZE_URL server support function can be called from an Internet Server API (ISAPI) filter to normalize a URL. The normalization performed by the SF_REQ_NORMALIZE_URL server support function appears similar to the normalization performed by Http.sys when Http.sys first receives the request.

However, there may be cases where there are differences in how the SF_REQ_NORMALIZE_URL server support function and Http.sys normalize a URL. In these cases, the custom ISAPI filter can be modified to normalize a URL in a way that meets the requirements of the custom application.

Case 1: Backslashes in an incoming URL

The normalization is different when an incoming URL contains backslashes. For example, the following request is received:

http://www.example.com/RootTest/SubDir\LowerDir/

Http.sys normalizes this URL as the following URL:

http://www.example.com/RootTest/SubDir/LowerDir/

Note The backslash is changed to a forward slash.

The SF_REQ_NORMALIZE_URL server support function normalizes this URL as the following URL:

http://www.example.com/RootTest/SubDir\LowerDir/

Case 2: Directory traversal

The normalization is different when directory traversal is used. For example, the following request is received:

http://www.example.com/RootTest/SubDir1\SubDir2/../../SubDir5/SubDir6

Http.sys normalizes this URL as the following URL:

http://www.example.com/RootTest/SubDir5/SubDir6

Note The backslash is changed to a forward slash.

The SF_REQ_NORMALIZE_URL server support function normalizes this URL as the following URL:

http://www.example.com/SubDir5/SubDir6

In both of these cases, you can avoid the problem that is caused by the differences in how the SF_REQ_NORMALIZE_URL server support function and Http.sys normalize a URL. To avoid the problem, call the GetServerVariable function instead of the GetHeader function to retrieve the URL. Then, pass the URL to the SF_REQ_NORMALIZE_URL server support function. The value of the URL that is returned by the GetServerVariable function is populated by Http.sys after Http.sys normalizes the raw URL.

For more information about ISAPI filter development, visit the following Microsoft Developer Network (MSDN) Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/iissdk/html/77b95fc9-e7de-471a-8de9-fee27c816cc3.asp

Modification Type:MajorLast Reviewed:6/14/2005
Keywords:kbtshoot kbinfo KB896287 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.