Parent Paths

Discussion in 'ASP General' started by news.microsoft.com, Oct 26, 2004.

  1. If I've enabled Parent Paths (PP) in IIS, but have installed the URL Filter
    and disallowed ".." and "../" within links, am I covered from the
    vulnerabilities of PP's?

    This allows me to use PP's in #Include statements, but doesn't allow
    visitors to use PP's in their links to access directories on my server.

    Is this correct?

    TIA
     
    news.microsoft.com, Oct 26, 2004
    #1
    1. Advertising

  2. Sounds like it would work...are you able to test it and see?

    --
    Ben Strackany
    www.developmentnow.com


    "news.microsoft.com" <> wrote in message
    news:%...
    > If I've enabled Parent Paths (PP) in IIS, but have installed the URL

    Filter
    > and disallowed ".." and "../" within links, am I covered from the
    > vulnerabilities of PP's?
    >
    > This allows me to use PP's in #Include statements, but doesn't allow
    > visitors to use PP's in their links to access directories on my server.
    >
    > Is this correct?
    >
    > TIA
    >
    >
     
    Ben Strackany, Oct 28, 2004
    #2
    1. Advertising

  3. news.microsoft.com

    Mike Guest

    Yes, it does work. I was just wondering if there were any other
    vulnerabilities that I might have missed (in regards to using Parent Paths)


    "Ben Strackany" <> wrote in message
    news:%...
    > Sounds like it would work...are you able to test it and see?
    >
    > --
    > Ben Strackany
    > www.developmentnow.com
    >
    >
    > "news.microsoft.com" <> wrote in message
    > news:%...
    > > If I've enabled Parent Paths (PP) in IIS, but have installed the URL

    > Filter
    > > and disallowed ".." and "../" within links, am I covered from the
    > > vulnerabilities of PP's?
    > >
    > > This allows me to use PP's in #Include statements, but doesn't allow
    > > visitors to use PP's in their links to access directories on my server.
    > >
    > > Is this correct?
    > >
    > > TIA
    > >
    > >

    >
    >
     
    Mike, Oct 28, 2004
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Noah
    Replies:
    5
    Views:
    791
  2. John Dolinka
    Replies:
    0
    Views:
    327
    John Dolinka
    May 31, 2007
  3. A.M

    Parent paths

    A.M, Feb 26, 2004, in forum: ASP .Net Security
    Replies:
    1
    Views:
    108
    richlm
    Feb 26, 2004
  4. RM

    Blocking parent paths (ASP.NET equivalent)

    RM, Jul 20, 2004, in forum: ASP .Net Security
    Replies:
    1
    Views:
    105
    Wes Henderson
    Jul 22, 2004
  5. Ohad Lutzky

    Paths, gentleman, paths

    Ohad Lutzky, Nov 6, 2006, in forum: Ruby
    Replies:
    2
    Views:
    202
    David Vallner
    Nov 7, 2006
Loading...

Share This Page