8

After updating our systems with the recently released asp.net vulnerability patch ms11-100, we found that some of our pages started failing with the exception "[HttpException (0x80004005): The URL-encoded form data is not valid.]" This is covered in the asp.net forums here:

http://forums.asp.net/t/1754512.aspx/1?Microsoft+security+bulletin+MS11+100+breaking+our+site

and on stackoverflow here:

ASP.NET MS11-100: how can I change the limit on the maximum number of posted form values?

What I tried to attempt is to limit the changes suggested thereby the attack area to the specific page by moving that page to it's own folder, so that I can have a specific web.config in that folder with the setting of aspnet:MaxHttpCollectionKeys having a value larger than the default of 1000.

I found that unless I specify this setting in the web.config in the root folder, this setting did not take effect. It seemed like asp.net just ignored the setting when it was in the web.config in the new folder for the page.

Is there something else I need to do to make this happen? Or is it not possible at all because of the nature of the setting?

4

2 回答 2

4

根据我对这些东西的工作原理的理解 - 我怀疑您是否可以使用文件夹级别的 web.config 更改该设置。看起来 MaxHttpCollectionKeys 属于应用程序池级别，因此要更改基本值 - 您应该创建另一个应用程序池。

于 2012-01-22T09:23:21.960 回答
1

我也试图把它放在一个子文件夹中，但没有运气。只要我把它放在根 web.config 中，它就起作用了。

于 2012-04-04T10:42:25.370 回答