Preventing asp.net pages from executing in a sub-folder - asp.net

Question

I have a dotnet site which contains a virtual directory (/ArticleImages) which maps to a file share on another server. The file share is accessible to a large number of people so, as a security measure, I do not want any asp.net pages to execute in this folder (e.g. putting default.aspx in the file share and browsing to site.com/ArticleImages/default.aspx should either not serve or, preferably, serve as a simple download rather than executing).
I'm using IIS 6.0 and added the virtual directory. If I remove the application from this folder, it uses the parent application and complains that it can't read web.config. If I add an application to this folder, even if I remove all application extensions, it complains that svc-xyzzy (the account used to access the share) doesn't have access to 'C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files'.
How do I have a sub folder of an application which does not execute dotnet code?

Answer 1

If the file share is readable by the user that your app pool is running under (Network Service by default) you can remove the virtual directory completely and create an ASP.NET application that will stream the files to the browser. If you're using MVC it's simply returning a file result. This has an added benefit in that you will be able to restrict the users from downloading the files. i.e. You can require that a user is logged in or has certain permissions to download the files. Also make sure you test for path traversal, you would not want a user entering ../../filename to download files they are not permitted to.
Option 1: ASP.NET MVC
public ActionResult Download(string file)
{
// Check for directory traversal attack
if(file.IndexOf('\\') > -1 || file.IndexOf('/') > -1)
{
return new HttpNotFoundResult();
}
file = System.IO.Path.Combine("\\FILE_SHARE_FOLDER\\", file);
if(!System.IO.File.Exists(file))
{
return new HttpNotFoundResult();
}
return this.File(file, GetMimeType(file));
}
Option 2: Webforms
private void DownloadFile(string file)
{
// Check for directory traversal attack
if(file.IndexOf('\\') > -1 || file.IndexOf('/') > -1)
{
Response.StatusCode = 404;
Response.End();
}
file = System.IO.Path.Combine("\\FILE_SHARE_FOLDER\\", file);
if (!System.IO.File.Exists(file))
{
Response.StatusCode = 404;
Response.End();
}
Response.ContentType = GetMimeType(file);
Response.TransmitFile(file);
}
Note You will need a method to get the MIME Types for both MVC and Webforms (MIME Type Method From KodeSharp)
private string GetMimeType(string fileName)
{
string mimeType = "application/unknown";
string ext = System.IO.Path.GetExtension(fileName).ToLower();
Microsoft.Win32.RegistryKey regKey = Microsoft.Win32.Registry.ClassesRoot.OpenSubKey(ext);
if (regKey != null && regKey.GetValue("Content Type") != null)
mimeType = regKey.GetValue("Content Type").ToString();
return mimeType;
}

Answer 2

You can check on global.asax for the request, and if is coming from the directories that you not allow, then stop the processing as:
protected void Application_BeginRequest(Object sender, EventArgs e)
{
string cTheFile = HttpContext.Current.Request.Path;
if(cTheFile.StartsWith("/articleimages", StringComparison.CurrentCultureIgnoreCase)
{
HttpContext.Current.Response.TrySkipIisCustomErrors = true;
HttpContext.Current.Response.Write("Please start from home page");
HttpContext.Current.Response.StatusCode = 403;
HttpContext.Current.Response.End();
return ;
}
}
Of course you can simple place one extra web.config on the directory with this inside:
<configuration>
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</configuration>
but if they can delete it is not useful as the code.