500 error with ampersands in URL

[satyenshah Profile]

Helicon Ape throws a 500 error when accessing a URL containing ampersands.

It seems to be that if you open the URL:
http://www.example.gov/j26%j.txt

Then IIS urldecodes it to:
http://www.example.gov/j&j.txt

Which then crashes with Ape serving a 500 error. My environment is Win2012 and Ape 0.99. A long time ago I observed the same behavior with Ape on Win2008. My .htaccess is:

# Helicon Ape version 3.1.0.99
RewriteEngine on
# Defend from some worm attacks
RewriteRule .*(?:global.asa|default\.ida|root\.exe|.*\.inc|\.\.).* . [F,I,O]
#Enforce www.example.gov in URL.
RewriteCond %{HTTP:Host} !^(www\.example\.gov|10\.241\.250\.22)$
RewriteRule (.*) http://www.example.gov/$1 [NC,L]

One workaround I've found is switching from an Integrated to a Classic app pool, effectively disabling Ape.

[HeliconAndrew]

Hello,

My initial suggestion would be to try NE or NU flags in your rule.
However, it's also good to take a look at rewrite.log and see how the request is processed. YOu can enable logging by uncommenting corresponding 2 lines in httpd.conf.

Regards
Andrew

[satyenshah Profile]

Still encountering that 500 error with http://www.example.gov/j%26j.txt. Tried a few things:

1) adding NE and NU flags, both separately and together. Still get error.
2) disabled .htaccess by commenting out #RewriteEngine On in .htaccess. Still get error.
3) enabling Ape logging by uncommenting the lines in httpd.conf. Nothing is logged at the time I access the j&j.txt page.
4) running procmon, all I see is w3wp.exe reading the j&j.txt file. Then a bunch of registry key reads, then w3wp.exe reads my custom 500-error page.
5) In windows event viewer, I don't see any events related to the j&j.txt page
6) In windows event viewer, I do see a logged event of another page throwing a 500 error. That page involves a rewriteproxy of "addtocalendar.ics" to "addtocalendar.ics.asp" (basically like a rewritemap presenting an ASP page as an ICS ical file) which worked fine in isapirewrite3 and now crashes in Ape. The logged event is:


Exception information:
Exception type: NullReferenceException
Exception message: Object reference not set to an instance of an object.

Request information:
Request URL: http://www.example.gov/publicworks/addtocalendar.ics.apehandler?streetid=195&upcomingdate=4/12/2013
Request path: /publicworks/addtocalendar.ics.apehandler
User host address: 192.168.1.1
User:
Is authenticated: False
Authentication Type:
Thread account name: CONTOSO\iis_usr

Thread information:
Thread ID: 18
Thread account name: CONTOSO\iis_usr
Is impersonating: False
Stack trace: at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)


Custom event details:

I'm observing the same error on a Win2008R2/IIS7.5 server. On your server does Ape work with ampersands?

[HeliconAndrew]

Hello,

You mentioned that you faced this before, so I dug in our knowledge base and found the following:

We’ve received complains regarding the issue and currently the only workaround is to use ASP.NET 4, because apparently it can be configured to allow special characters. We can’t modify anything within Helicon Ape because the module even doesn’t get control when ASP.NET thinks a request isn’t appropriate.

Regards
Andrew