AjaxControlToolkit icon indicating copy to clipboard operation
AjaxControlToolkit copied to clipboard

Encode AjaxFileUpload Context Key

Open microalps opened this issue 3 years ago • 0 comments

Resolves #414 (see last comment)

The contextKey parameter is hard-coded to include curly braces { and }. This key is then injected into the URL used to upload files via the AjaxFileUpload control. These characters are not allowed per RFC 3986 §3.4. For convenience, I'll quote https://stackoverflow.com/a/31300627

Thus, in addition to all alphanumerics and percent encoded characters, a query can legally include the following unencoded characters:

/ ? : @ - . _ ~ ! $ & ' ( ) * + , ; =

For my specific issue description (various users reported this in the ticket)

The AJAX Control Toolkit version you are using.

20.1

The installation method (installer, NuGet package or a custom build from the source code)

NuGet

An expected result.

URL should encode it's parts, e.g. ?contextKey=%7BDA8BEDC8-B952-4d5d-8CC2-59FE922E2923%7D&controlID=ctlUpload&start=1&queue=1

An actual result.

?contextKey={DA8BEDC8-B952-4d5d-8CC2-59FE922E2923}&controlID=ctlUpload&start=1&queue=1

A browser(s) you are using.

Chromium-Based Edge v94.0.992.38 (64-bit)

A site deploy method (VS development web-server, IIS).

IIS

microalps avatar Oct 13 '21 18:10 microalps