title: ASP.Net MVC, JS injection and System.ArgumentException - Illegal Characters in path
body: <p>In my ASP.Net MVC application, I use <strong>custom error handling</strong>.
  I want to perform custom actions for each error case I meet in my application.</p>
  
  <p>So I override <strong>Application_Error</strong>, get the  <strong>Server.GetLastError();</strong>
  and do my business depending on the exception, the current user, the current URL (the application runs on many domains), the user IP, and many others.</p>
  
  <p>Obviousely, the application is often the target of hackers.
  In almost all the case it's not a problem to detect and manage it, but for some <strong>JS URL attacks</strong>, my error handling does not perform what I want it to do.
  Ex (from logs) :</p>
  
  <pre><code>http://localhost:1809/Scripts/]||!o.support.htmlSerialize&amp;&amp;[1
  </code></pre>
  
  <p>When I got such an URL, an exception is raised when accessing the <strong>ConnectionStrings</strong> section in the <strong>web.config</strong>, and I can't even redirect to another URL.</p>
  
  <p>It leads to a "<strong><em>System.ArgumentException - Illegal Characters in path</em></strong>, etc."</p>
  
  <p>The screenshot below shows the problem :
  <a href="http://screencast.com/t/Y2I1YWU4" rel="nofollow noreferrer">http://screencast.com/t/Y2I1YWU4</a></p>
  
  <p>An obvious solution is to write a <strong>HTTP module</strong> to filter the urls before they reach my application, but I'd like to avoid it because :</p>
  
  <ul>
  <li>I like having the whole security being managed in one place (in the <strong>Application_Error()</strong> method)</li>
  <li>In the module I cannot access the whole data I have in the application itself (application specific data I don't want to debate here)</li>
  </ul>
  
  <p><strong>Questions :</strong>
  Did you meet this problem ?
  How did you manage it ?</p>
  
  <p>Thanks for you suggestions,</p>
  
  <p>Mose</p>
  
  <p><em>PS : here is the stack trace :</em></p>
  
  <pre><code>System.ArgumentException: Illegal characters in path.
  at System.IO.Path.CheckInvalidPathChars(String path)
  at System.IO.Path.Combine(String path1, String path2)
  at System.Web.Configuration.UserMapPath.GetPhysicalPathForPath(String path, VirtualDirectoryMapping mapping)
  at System.Web.Configuration.UserMapPath.GetPathConfigFilename(String siteID, VirtualPath path, String&amp; directory, String&amp; baseName)
  at System.Web.Configuration.UserMapPath.MapPath(String siteID, String path)
  at System.Web.Hosting.HostingEnvironment.MapPathActual(VirtualPath virtualPath, Boolean permitNull)
  at System.Web.Hosting.HostingEnvironment.MapPathInternal(VirtualPath virtualPath, Boolean permitNull)
  at System.Web.CachedPathData.GetPhysicalPath(VirtualPath virtualPath)
  at System.Web.CachedPathData.GetConfigPathData(String configPath)
  at System.Web.CachedPathData.GetVirtualPathData(VirtualPath virtualPath, Boolean permitPathsOutsideApp)
  at System.Web.HttpContext.GetFilePathData()
  at System.Web.HttpContext.GetConfigurationPathData()
  at System.Web.Configuration.RuntimeConfig.GetConfig(HttpContext context)
  at System.Web.HttpContext.get_ImpersonationToken()
  at System.Web.ClientImpersonationContext.Start(HttpContext context, Boolean throwOnError)
  at System.Web.HttpApplication.ThreadContext.Enter(Boolean setImpersonationContext)
  at System.Web.HttpApplication.OnThreadEnterPrivate(Boolean setImpersonationContext)
  at System.Web.HttpApplication.ApplicationStepManager.ResumeSteps(Exception error)
  </code></pre>