access denied to PDF file (when Response.WriteFile)

[LP]

Hi,

I have a reporting application that exports data to different format and
sends file to the browsers with the following code:

string fileName = @"" + Request.QueryString["filename"];
//fileName = Request.QueryString["filename"];

if (fileName.Length==0)
{
Response.Redirect("default.aspx", true);
return;
}
fileName = Server.MapPath(fileName);
System.IO.FileInfo TargetFile = new System.IO.FileInfo(fileName);

Response.Clear();
Response.AddHeader("Content-Disposition", "attachment; filename=BLT
report");
Response.AddHeader("Content-Length", TargetFile.Length.ToString());

Response.ContentType = "application/octet-stream";

Response.WriteFile(fileName);

// stop the execution of this page
Response.Flush();

Excel format works no problem, but only PDF gives access denied. Do I need
to give special permisions to pdf files?

thank you

 

[Brock Allen]

Hmm, I don't know what's wrong with the PDF, but one comment about your code:
Beware a path injection attack. I could modify your QueryString and pass
something like:

http://YourSite.Com/YourPage.aspx?filename=web.config

And now you've handed me web.config. So you should validate the filename
and don't pass it back if it's not something you want to hand me.

 

[LP]

Thanks, Allen,

The work around PDF was opening popup Window with URL to PDF file.

I appreciate your concern, however for now it's an Intranet application, but
certainly something to worry about, I will put file name validation.

Hmm, I don't know what's wrong with the PDF, but one comment about your code:
Beware a path injection attack. I could modify your QueryString and pass
something like:

http://YourSite.Com/YourPage.aspx?filename=web.config

And now you've handed me web.config. So you should validate the filename
and don't pass it back if it's not something you want to hand me.

Hi,

I have a reporting application that exports data to different format
and sends file to the browsers with the following code:

string fileName = @"" + Request.QueryString["filename"];
//fileName = Request.QueryString["filename"];
if (fileName.Length==0)
{
Response.Redirect("default.aspx", true);
return;
}
fileName = Server.MapPath(fileName);
System.IO.FileInfo TargetFile = new System.IO.FileInfo(fileName);
Response.Clear();
Response.AddHeader("Content-Disposition", "attachment; filename=BLT
report");
Response.AddHeader("Content-Length", TargetFile.Length.ToString());
Response.ContentType = "application/octet-stream";

Response.WriteFile(fileName);

// stop the execution of this page
Response.Flush();
Excel format works no problem, but only PDF gives access denied. Do I
need to give special permisions to pdf files?

thank you