Parent Paths

[news.microsoft.com]

If I've enabled Parent Paths (PP) in IIS, but have installed the URL Filter
and disallowed ".." and "../" within links, am I covered from the
vulnerabilities of PP's?

This allows me to use PP's in #Include statements, but doesn't allow
visitors to use PP's in their links to access directories on my server.

Is this correct?

TIA

 

[Ben Strackany]

Sounds like it would work...are you able to test it and see?

 

[Mike]

Yes, it does work. I was just wondering if there were any other
vulnerabilities that I might have missed (in regards to using Parent Paths)