Catching directory transversals passed through QueryString

[Merennulli]

Ok, the gist of the problem is I have a site my predecessor created
that much of it goes through a single asp.net app. For some reason,
instead of using templates or includes, he passed everything through
this one bit of code that dumped html and flat text in the middle of
the page. To keep it dynamic, he has the querystring take in a
filename. eg.
http://www.oursite.net/default.aspx?filename=/folder/file.txt

Of course, this leaves it wide open for
http://www.oursite.net/default.aspx?filename=../web.config
or
http://www.oursite.net/default.aspx?filename=../../../Inetpub/wwwroot/default.aspx
or worse.

For now, I'm just using regex to require either ".txt" or ".htm?" and
then catch "../" and hit the breaks if it finds that. I'm concerned,
though, that there might be other ways of exploiting this.

 

[Kevin Spencer]

Imagine what would happen if everyone in your city used the same server to
access the Internet. That's what sort of problem you have on your hands. If
I were you, I'd throw the whole concept out the window.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer

Presuming that God is "only an idea" -
Ideas exist.
Therefore, God exists.

 

[Merennulli]

Thats all fine and dandy for the long run, but this is a site that's up
and running and needs to stay so. I can't redevelop the site overnight.
I'm looking to lock down as best I can what my predecessor put in
place, and develop a new architecture this summer when we're not in
session. I work with state legislature, our office has priorities
higher than the website during session, so I can only allot so much
time to this until June.