ASP.NET MVC UrlHelper.GenerateUrl 异常：“不能使用前导 .. 退出顶级目录”

Question

我正在使用 IIS 7 重写模块来重写传入的 url，例如：

http://server/year/all

到

http://server/application/controller/year/all

一切正常，除了在处理重写的请求时，我使用 MVC 的 UrlHelper.GenerateUrl() 方法：

UrlHelper.GenerateUrl(
   "Assets",
   "Css",
   "Asset",
   new RouteValueDictionary(new { site = site.Name, assetPath = assetPath }),
   RouteTable.Routes,
   controllerContext.RequestContext,
   false);

调用此方法会导致 HttpException：

System.Web.HttpException: Cannot use a leading .. to exit above the top directory.
   at System.Web.Util.UrlPath.ReduceVirtualPath(String path)
   at System.Web.Util.UrlPath.Reduce(String path)
   at System.Web.VirtualPath.Combine(VirtualPath relativePath)
   at System.Web.VirtualPathUtility.Combine(String basePath, String relativePath)
   at System.Web.Mvc.PathHelpers.GenerateClientUrlInternal(HttpContextBase httpContext, String contentPath)
   at System.Web.Mvc.PathHelpers.GenerateClientUrl(HttpContextBase httpContext, String contentPath)
   at System.Web.Mvc.UrlHelper.GenerateUrl(String routeName, String actionName, String controllerName, RouteValueDictionary routeValues, RouteCollection routeCollection, RequestContext requestContext, Boolean includeImplicitMvcValues)

查看RequestContext，似乎所有请求路径都是正确的（即，具有重写的值）。我似乎无法弄清楚为什么它试图退出顶级目录......我们没有在任何地方使用......在路径中。

我还确保 RewriteModule 位于 IIS 中的 UrlRouting 模块上方。

虽然我可以进入框架方法，但我无法检查任何局部变量（在 VS 或 WinDbg 中），因为它已经过编译器优化。

有什么想法吗？

Answer 1

工作解决方案是在 Url.Content/UrlHelper.GenerateContentUrl 之前插入一行（最好的位置是 Application_BeginRequest）：

System.Web.HttpContext.Current.Items.Add("IIS_WasUrlRewritten", "false");

我的答案是上述 2 个答案（Rick Schott 和 Thom）的结果。两者都非常正确，但这并没有帮助。 我在https://github.com/aspnet/AspNetWebStack/blob/master/src/ 学习了堆栈跟踪中两个类（System.Web.WebPages.Utils.UrlRewriterHelper.cs 和 System.Web.WebPages.Utils.UrlUtil.cs）的源代码：

System.Web.HttpException (0x80004005): Cannot use a leading .. to exit above the top directory. 
at System.Web.Util.UrlPath.ReduceVirtualPath(String path) 
at System.Web.Util.UrlPath.Reduce(String path) 
at System.Web.VirtualPath.Combine(VirtualPath relativePath) 
at System.Web.VirtualPathUtility.Combine(String basePath, String relativePath) 
at System.Web.WebPages.UrlUtil.GenerateClientUrlInternal(HttpContextBase httpContext, String contentPath) 
at System.Web.WebPages.UrlUtil.GenerateClientUrlInternal(HttpContextBase httpContext, String contentPath) 
at System.Web.WebPages.UrlUtil.GenerateClientUrl(HttpContextBase httpContext, String basePath, String path, Object[] pathParts) 

System.Web.WebPages.Utils.UrlUtil.cs 中有代码 - GenerateClientUrlInternal 方法：

if (!wasRequestRewritten)
            {
                return contentPath;
            }

            // Since the rawUrl represents what the user sees in his browser, it is what we want to use as the base
            // of our absolute paths. For example, consider mysite.example.com/foo, which is internally
            // rewritten to content.example.com/mysite/foo. When we want to generate a link to ~/bar, we want to
            // base it from / instead of /foo, otherwise the user ends up seeing mysite.example.com/foo/bar,
            // which is incorrect.
            string relativeUrlToDestination = MakeRelative(httpContext.Request.Path, contentPath);
            string absoluteUrlToDestination = MakeAbsolute(httpContext.Request.RawUrl, relativeUrlToDestination);
            return absoluteUrlToDestination;

您可能会看到带有作者对 url 重写路径的注释的奇怪行。此外，原始客户端路径在 HttpContext.Request.RawUrl 中，但在 Url 中被重写。 期待System.Web.WebPages.Utils.UrlRewriterHelper.cs：

 if (httpContext.Items.Contains(UrlWasRewrittenServerVar))
            {
                return Object.Equals(httpContext.Items[UrlWasRewrittenServerVar], UrlWasRequestRewrittenTrueValue);
            }
            else
            {
                HttpWorkerRequest httpWorkerRequest = (HttpWorkerRequest)httpContext.GetService(typeof(HttpWorkerRequest));
                bool requestWasRewritten = (httpWorkerRequest != null && httpWorkerRequest.GetServerVariable(UrlWasRewrittenServerVar) != null);

                if (requestWasRewritten)
                {
                    httpContext.Items.Add(UrlWasRewrittenServerVar, UrlWasRequestRewrittenTrueValue);
                }
                else
                {
                    httpContext.Items.Add(UrlWasRewrittenServerVar, UrlWasRequestRewrittenFalseValue);
                }

                return requestWasRewritten;
            }

如果我们使用“false”值将虚拟值写入 HttpContext.Items[UrlWasRewrittenServerVar]，我们会跳过 httpWorkerRequest.GetServerVariable(UrlWasRewrittenServerVar) != null 检查。 所以 Url.Content 现在可以工作了。

Answer 2

这是一个涉及私有实现细节的怪诞解决方法，但添加以下内容：

HttpContext.Current.Request.ServerVariables.Remove("IIS_WasUrlRewritten");

这避免了在PathHelper.GenerateClientUrlInternal 中进行的内部检查，以查看请求是否被重写。正如参考资料中的这条评论所暗示的那样，这很可能会破坏某些场景：

// Since the rawUrl represents what the user sees in his browser, it is what we want to use as the base 
// of our absolute paths. For example, consider mysite.example.com/foo, which is internally 
// rewritten to content.example.com/mysite/foo. When we want to generate a link to ~/bar, we want to
// base it from / instead of /foo, otherwise the user ends up seeing mysite.example.com/foo/bar, 
// which is incorrect.

Answer 3

不确定是否有帮助，但这是引发异常的代码：

internal static string ReduceVirtualPath(string path)
{
    int length = path.Length;
    int startIndex = 0;
    while (true)
    {
        startIndex = path.IndexOf('.', startIndex);
        if (startIndex < 0)
        {
            return path;
        }
        if (((startIndex == 0) || (path[startIndex - 1] == '/')) && ((((startIndex + 1) == length) || (path[startIndex + 1] == '/')) || ((path[startIndex + 1] == '.') && (((startIndex + 2) == length) || (path[startIndex + 2] == '/')))))
        {
            break;
        }
        startIndex++;
    }
    ArrayList list = new ArrayList();
    StringBuilder builder = new StringBuilder();
    startIndex = 0;
    do
    {
        int num3 = startIndex;
        startIndex = path.IndexOf('/', num3 + 1);
        if (startIndex < 0)
        {
            startIndex = length;
        }
        if ((((startIndex - num3) <= 3) && ((startIndex < 1) || (path[startIndex - 1] == '.'))) && (((num3 + 1) >= length) || (path[num3 + 1] == '.')))
        {
            if ((startIndex - num3) == 3)
            {
                if (list.Count == 0)
                {
                    throw new HttpException(SR.GetString("Cannot_exit_up_top_directory"));
                }
                if ((list.Count == 1) && IsAppRelativePath(path))
                {
                    return ReduceVirtualPath(MakeVirtualPathAppAbsolute(path));
                }
                builder.Length = (int) list[list.Count - 1];
                list.RemoveRange(list.Count - 1, 1);
            }
        }
        else
        {
            list.Add(builder.Length);
            builder.Append(path, num3, startIndex - num3);
        }
    }
    while (startIndex != length);
    string str = builder.ToString();
    if (str.Length != 0)
    {
        return str;
    }
    if ((length > 0) && (path[0] == '/'))
    {
        return "/";
    }
    return ".";
}