Here’s how to add metadata and stylesheet management by making a subclass which we’ll call PageBase, since all markup pages will inherit from it.

Features

• One-line method calls for common operations like adding a stylsheet reference or changing metadata.
• Duplicate stylsheet/meta tag prevention.
• Only 2 instance members will be added to PageBase – .Stylesheets and .Metadata.
  Stylesheet (HtmlLink) and Metadata (HtmlMeta) management is encapsulated in separate classes to keep things clean, and reduce methods inside the page class.
• Static PageBase.GetControlsOfType<t>(Control parent) method simplifies all kinds of hierarchy querying.

StylesheetManager methods

Complete documentation is in the XML comments in the code.

Page.Stylesheets.AddLink("~/css/effects/css","stylesheet", "text/css");
Page.Stylesheets.AddLink("~/css/effects/css"); //Shorter syntax for typcial usage
Page.Stylesheets.AddLinkIfMissing("~/css/effects/css"); //So User Controls and multi-instance objects can safely include stylesheets without worrying about duplicates.
Page.Stylesheets.RemoveLinks("~/css/effects/css"); //Removes all links matching this path (ResolveUrl() is called on all paths prior to comparison)
Page.Stylesheets.GetControls() //returns all HtmlLink controls within the page header.
Page.Stylesheets.GetHrefs() //Returns a collection of all hrefs from the link tags on the page.
Page.Stylesheets.FindLinkControl(string href); //Case-insensitive, ResolveURL-cleaned search by href value.

MetadataManager methods

Page.Metadata["description"] = "Why everybody ends up extending the Page class".
if (Page.Metadata["description"] == "Why everybody ends up extending the Page class"){}

// Returns a collection of all HtmlMeta controls in the header
// Calls  PageBase.GetControlsOfType<HtmlMeta>(_page.Header);
Page.Metadata.GetControls();
Page.Metadata.GetNameContentPairs(); //Returns a NameValueCollection of the metadata name/content pairs.
Page.Metadata.GetControl("description") // Returns the first HtmlMeta instance matching the specified name attribute
Page.Metadata.RemoveControls(List<HtmlMeta>) //Detaches each item in the collection from its parent
Page.Metadata.HideControls(List<HtmlMeta>) //Sets .Visible and .EnableViewState to "false" on all items.
Page.Metadata.GetMatches(query) //Returns all HtmlMeta instances with matching Name attributes. Query can be "*" or a comma-delimited list of values like "description,keywords,test"
Page.Metadata.GetNonMatches(quer) //Returns all non-matching HtmlMeta instances

Usage

We can use this base class in any page my making a single change.
If the page has a code-behind file, just change

public partial class _Default : System.Web.UI.Page

to

public partial class _Default : fbs.PageBase

If it is a standalone .aspx file, you can set Inherits="fbs.PageBase".

Internals

All of the querying operations performed only affect controls of a certain type. To greatly simplify the code for both StylesheetManager and MetdataManager, we have added GetControlsOfType<t>(Control parent) to the PageBase class.

This method efficiently builds a collection of all controls in the specified hierarchy that are of type T.

/// <summary>
/// Iterates over the control structure of the specified object and returns all elements that are
/// of the specified type
/// </summary>
/// <param name="parent"></param>
/// <returns></returns>
public static List<T> GetControlsOfType<T>(Control parent) where T : Control
{
	return GetControlsOfType<T>(parent, false,false);
}
/// <summary>
/// Iterates over the control structure of the specified object and returns all elements that are
/// of the specified type. If there are two items of the specified type, and one is a child of the other,
/// the childrenOnly and parentOnly parameters can be used to control which is selected. If both are false, both controls are returned.
/// </summary>
/// <param name="parent">The control to search</param>
/// <param name="childrenOnly">If true, only the innermost matching children will be returned.</param>
/// <param name="parentsOnly">If true, only the outermost matching parents will be returned.</param>
/// <returns></returns>
public static List<T> GetControlsOfType<T>(Control parent, bool childrenOnly, bool parentsOnly) where T : Control
{
	if (parent == null) return null;
	if (childrenOnly && parentsOnly) throw
		new ArgumentException("Only one of childrenOnly and parentsOnly may be true. They are mutually exclusive");

	//We are doing last-minute initialization to minimize the overhead of building one of these.
	//The List<> constructor should only be called n times, where n is the number of ContentPlaceHolder controls.
	List<T> temp = null;

	if (parent.Controls != null)
	{
		//Loop through all of the child controls
		foreach (Control child in parent.Controls)
		{
			//Recursively search them also.
			List<T> next = GetControlsOfType<T>(child,childrenOnly,parentsOnly);

			//To save on initialization costs.
			if (next != null)
			{
				if (temp == null)
				{
					temp = next; //Use existing collection from recursive call
				}
				else
				{
					//Merge the collections

					//If a the same object is the child of two different parents, this will
					//stop it.
					foreach (T c in next)
					{
						if (!temp.Contains(c)) temp.Add(c);
					}

				}
			}
		}
	}

	//If this item is of the target type, add it
	if ((parent is T))
	{
		//If there are no children or we are trying to discard children
		if (parentsOnly || temp == null)
		{
			//Clear the list and add the parent
			T item = (T)parent;

			temp = new List<T>();

			temp.Add(item);
		}
		else if (!childrenOnly)
		{
			//Append the parent with the children
			T item = (T)parent;

			if (temp == null) temp = new List<T>();

			temp.Add(item);
		}
	}

	return temp;
}

The remainder of the PageBase class

/// 

/// Extends System.Web.UI.Page
/// Adds metadata and stylehseet management
/// 
public partial class PageBase : Page
{

/// <summary>
/// Creates a new PageBase instance.
/// </summary>
public PageBase()
{
}

protected MetadataManager _metadata = null;
/// <summary>
/// Manages page metadata. Add, remove, and query metadata
/// (Only meta tags with a name attribute are affected, and only those located in the head section)
/// </summary>
public MetadataManager Metadata {
	get {
		if (_metadata == null) _metadata = new MetadataManager(this);
		return _metadata;
	}
}

protected LinkManager _Stylesheets = null;
/// <summary>
/// Manages all of the HtmlLink controls in the head section of the page.
/// Register, delete, and enumerate all link tags.
/// </summary>
public LinkManager Stylesheets
{
	get
	{
		if (_Stylesheets == null) _Stylesheets = new LinkManager(this);
		return _Stylesheets;
	}
}

LinkManager

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Collections.Generic;
using System.IO;
using System.Text;
using System.Diagnostics;
using System.Text.RegularExpressions;
using System.Collections.Specialized;

namespace fbs
{
    public partial class PageBase
    {
        /// <summary>
        /// Manages &lt;link> tags (controls) on the current page.
        /// </summary>
        public class LinkManager
        {
            protected Page _page = null;
            /// <summary>
            /// Creates a new Link Manager attached to the specified Page instance
            /// </summary>
            /// <param name="parent"></param>
            public LinkManager(Page parent)
            {
                _page = parent;
            }
            /// <summary>
            /// Adds a CSS reference. Paths must be 1) relative to the page, 2) application-relative, or 3) absolute
            /// </summary>
            /// <param name="href"></param>
            public void AddLink(string href)
            {
                AddLink(href, "stylesheet", "text/css");
            }
            /// <summary>
            /// Adds a CSS stylsheet reference, but only if there isn't one yet for that path.
            /// Paths must be 1) relative to the page, 2) application-relative, or 3) absolute
            /// </summary>
            /// <param name="href"></param>
            /// <param name="resolveFirst">If true, compares resolved paths instead of raw paths</param>
            public void AddLinkIfMissing(string href)
            {
                if (this.FindLinkControl(href) == null)
                {
                    AddLink(href);
                }
            }
            /// <summary>
            /// Adds a link tag with the specified rel and type attributes
            /// Paths must be 1) relative to the page, 2) application-relative, or 3) absolute
            /// </summary>
            /// <param name="href"></param>
            /// <param name="rel"></param>
            /// <param name="type"></param>
            public void AddLink(string href, string rel, string type)
            {
                HtmlLink l = new HtmlLink();

                l.EnableViewState = false;
                l.Href = href;
                l.Attributes["type"] = type;
                l.Attributes["rel"] = rel;
                l.AppRelativeTemplateSourceDirectory = _page.AppRelativeTemplateSourceDirectory;
                _page.Header.Controls.Add(l);
            }
            /// <summary>
            /// Removes all meta tags with a matching href.
            /// Paths must be 1) relative to the page, 2) application-relative, or 3) absolute
            /// </summary>
            /// <param name="href"></param>
            /// <param name="resolveFirst">If true, compares resolved paths instead of raw paths</param>
            public void RemoveLinks(string href)
            {
                bool resolveFirst = false;
                List<HtmlLink> controls = GetControls();
                string searchfor = href;
                if (resolveFirst) searchfor = _page.ResolveUrl(searchfor);
                foreach (HtmlLink hl in controls)
                {
                    string thishref = hl.Href;

                    if (resolveFirst) thishref = _page.ResolveUrl(thishref);

                    if (thishref.Equals(searchfor, StringComparison.OrdinalIgnoreCase))
                    {
                        hl.Parent.Controls.Remove(hl);
                    }
                }

            }
            /// <summary>
            /// Returns a collection of all HtmlLink controls in the page header.
            /// </summary>
            /// <returns></returns>
            public List<HtmlLink> GetControls()
            {
                return PageBase.GetControlsOfType<HtmlLink>(_page.Header);
            }
            /// <summary>
            /// Returns a collection of the hrefs in each link tag in the head section.
            /// Paths are 1) relative to the page, 2) application-relative, or 3) absolute
            /// </summary>
            /// <returns></returns>
            public List<string> GetHrefs()
            {
                List<HtmlLink> list = GetControls();
                List<string> hrefs = new List<string>();
                foreach (HtmlLink l in list)
                {
                    hrefs.Add(l.Href);
                }
                return hrefs;
            }
            /// <summary>
            /// Case-insensitive. Returns the first HtmlLink control in the heirarchy that matches the href. Only scans inside the head tag.
            /// returns null if no match is found.
            ///
            /// </summary>
            /// <param name="href">Paths must be 1) relative to the page, 2) application-relative, or 3) absolute</param>
            /// <param name="resolveFirst">If true, compares resolved paths instead of raw paths</param>
            /// <returns></returns>
            public HtmlLink FindLinkControl(string href)
            {
                bool resolveFirst = false;
                List<HtmlLink> controls = GetControls();
                string searchfor = href;
                if (resolveFirst) searchfor = _page.ResolveUrl(searchfor);
                foreach (HtmlLink hl in controls)
                {
                    string thishref = hl.Href;

                    if (resolveFirst) thishref = _page.ResolveUrl(thishref);

                    if (thishref.Equals(searchfor, StringComparison.OrdinalIgnoreCase)) return hl;
                }
                return null;
            }

        }
    }
}

MetadataManager

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Collections.Generic;
using System.IO;
using System.Text;
using System.Diagnostics;
using System.Text.RegularExpressions;
using System.Collections.Specialized;

namespace fbs
{
    public partial class PageBase
    {
        /// <summary>
        /// Manages &lt;meta> tags (controls) on the current page. Not designed for HTTP-EQUIV tags - they are ignored and skipped unless they have a name attribute.
        /// Only deals with meta tags within the Head of the page. The page must have a server-side head tag.
        /// </summary>
        public class MetadataManager
        {
            protected Page _page = null;

            /// <summary>
            /// Creates a new MetadataManager and attaches it to the current page.
            /// </summary>
            /// <param name="parent"></param>

            public MetadataManager(Page parent)
            {
                _page = parent;
            }
            /// <summary>
            /// Gets or sets the Content attribute for the specified metadata tag.
            /// Returns null if pair does not exist.
            /// Creates a new metadata tag if it does not exist.
            /// </summary>
            /// <param name="name"></param>
            /// <returns></returns>
            public string this[string name]
            {

                get
                {
                    HtmlMeta m = FindMetaControl(name, _page.Header);
                    if (m == null) return null;
                    return m.Content;
                }
                set
                {
                    HtmlMeta m = FindMetaControl(name, _page.Header);
                    if (m != null)
                    {
                        m.Content = value;
                    }
                    else
                    {
                        HtmlMeta newm = new HtmlMeta();
                        newm.EnableViewState = false;
                        newm.Name = name;
                        newm.Content = value;
                        _page.Header.Controls.Add(newm);
                    }

                }

            }
            /// <summary>
            /// Returns a collection of all HtmlMeta controls in the header
            /// </summary>
            /// <returns></returns>
            public List<HtmlMeta> GetControls()
            {
                return PageBase.GetControlsOfType<HtmlMeta>(_page.Header);
            }
            /// <summary>
            /// Returns a name:value collection of meta name:content pairs from the page.
            /// If there are multiple meta tags with the same name, the contents are comma-delimited (NameValueCollection.Add behavior)
            /// </summary>
            /// <returns></returns>
            public NameValueCollection GetNameContentPairs()
            {
                List<HtmlMeta> list = PageBase.GetControlsOfType<HtmlMeta>(_page.Header);
                NameValueCollection pairs = new NameValueCollection();
                foreach (HtmlMeta m in list)
                {
                    pairs.Add(m.Name, m.Content);
                }
                return pairs;
            }
            /// <summary>
            /// Returns the first HtmlMeta control with the specified name
            /// </summary>
            /// <param name="name"></param>
            /// <returns></returns>
            public HtmlMeta GetControl(string name)
            {
                return FindMetaControl(name, this._page.Header);
            }
            /// <summary>
            /// Whether to include or exclude matches
            /// </summary>
            public enum FilterType
            {
                ReturnMatches = 1,
                ReturnNonMatches = 2
            }
            /// <summary>
            /// Returns all meta tags that don't match 'pattern'
            /// To exclude all, specify "*". Otherwise, specify a list of exclusions: "date,expires,description,flags".
            /// Not regex, but case-insensitive.
            /// </summary>
            /// <param name="pattern">To exclude all, specify "*". Otherwise, specify a list of exclusions: "date,expires,description,flags".</param>
            /// <returns></returns>
            public List<HtmlMeta> GetNonMatches(string pattern)
            {
                return GetMatches(pattern, FilterType.ReturnNonMatches);
            }
            /// <summary>
            /// Returns all meta tags with a name that matches 'pattern'
            /// To match all, specify "*". Otherwise, specify a list of possibilities: "date,expires,description,flags".
            /// Not regex, but case-insensitive.
            /// </summary>
            /// <param name="pattern">To match all, specify "*". Otherwise, specify a list of possibilities: "date,expires,description,flags".</param>
            /// <returns></returns>
            public List<HtmlMeta> GetMatches(string pattern)
            {
                return GetMatches(pattern, FilterType.ReturnMatches);
            }

            /// <summary>
            /// Removes the specified HtmlMeta controls from their parents.
            /// </summary>
            /// <param name="list"></param>
            public void RemoveControls(List<HtmlMeta> list)
            {
                foreach (HtmlMeta m in list)
                {
                    if (m.Parent != null)
                    {
                        m.Parent.Controls.Remove(m);
                    }
                }
            }

            /// <summary>
            /// Hides the specified HtmlMeta controls from rendering
            /// </summary>
            /// <param name="list"></param>
            public void HideControls(List<HtmlMeta> list)
            {
                foreach (HtmlMeta m in list)
                {
                    m.Visible = false;
                    m.EnableViewState = false;
                }
            }
            /// <summary>
            /// Returns a collection of HtmlMeta tags that match 'pattern' (or don't match, depending on 'filter').
            /// Pattern is not a regex, but supports alternations and is case-insensitive. if Pattern="*", then everything matches.
            /// Pattern can be a single meta name, or a list of meta names (comma or | delimited).
            /// </summary>
            /// <param name="pattern">To match all, specify "*". Otherwise, specify a list of possibilities: "date,expires,description,flags".</param>
            /// <param name="filter"></param>
            /// <returns></returns>
            public List<HtmlMeta> GetMatches(string pattern, FilterType filter)
            {

                //List of all meta controls in the head
                List<HtmlMeta> list = PageBase.GetControlsOfType<HtmlMeta>(_page.Header);

                //Parse pattern string
                bool wildcard = (pattern.Equals("*", StringComparison.OrdinalIgnoreCase));

                string[] parts = pattern.Replace(',', '|').Split('|');
                for (int i = 0; i < parts.Length; i++)
                    parts[i] = parts[i].Trim().ToLowerInvariant();

                //Index valid names in a binary tree
                List<string> names = new List<string>(parts);
                names.Sort();

                //Create collections to hold matches and non-matches.
                List<HtmlMeta> matches = new List<HtmlMeta>();
                List<HtmlMeta> nonmatches = new List<HtmlMeta>();

                //Loop throught controls and distribute to the appropriate collection.
                foreach (HtmlMeta m in list)
                {
                    //Skip meta tags with an no name (probably HTTP-EQIV)
                    if (m.Name == null) continue;

                    if (wildcard)
                    {
                        matches.Add(m);
                    }
                    else if ((names.BinarySearch(m.Name.ToLowerInvariant()) > 0))
                    {
                        matches.Add(m);
                    }
                    else
                    {
                        nonmatches.Add(m);
                    }
                }

                //Return the correct collection based upon the filter type
                if (filter == FilterType.ReturnMatches) return matches;
                else if (filter == FilterType.ReturnNonMatches) return nonmatches;
                else throw new ArgumentException("filter must be a valid enumeration value", "filter");
            }
            /// <summary>
            /// Recursively searches the hierarchy of 'parent' for the first HtmlMeta instance with the specified Name attribute.
            /// Case-insensitive.
            /// </summary>
            /// <param name="name">Case-insensitive. </param>
            /// <param name="parent">Control tree to search</param>
            /// <returns></returns>
            protected static HtmlMeta FindMetaControl(string name, Control parent)
            {
                if (parent is HtmlMeta)
                {
                    HtmlMeta m = parent as HtmlMeta;
                    if (m.Name.Equals(name, StringComparison.OrdinalIgnoreCase)) return m;
                }
                foreach (Control c in parent.Controls)
                {
                    HtmlMeta m = FindMetaControl(name, c);
                    if (m != null) return m;
                }
                return null;
            }

        }
    }
}

Integrating script support

If you haven’t already read Referencing stylesheets and scripts from content pages, give it a glance. Download the attached code files and combine them with this one. The only file you’ll have to merge is PageBase.cs.

Just add this code to the PageBase.cs included in the article, and make sure ContentPlaceHolderFixes.cs and the ScriptReference.cs files are included also.

/// <summary>
/// Calls the ContentPlaceHolderHeadRepair.Repair method
/// </summary>
/// <param name="e"></param>
protected override void OnLoad(EventArgs e)
{
	//Parses link, meta, and script tags that got missed by the Head>CPH bug.
	ContentPlaceHolderFixes.RepairPageHeader(this);

	//Fire the events later
	base.OnLoad(e);
}

This will allow you to use script tags from the head section and get proper ASP.NET URL resolution on them.

If you have any questions, please use the comments form below.

Happy coding!

Download files

ASP.NET is primarily concerned with “virtual paths”, the portion of the path following the hostname or port number. When working with ASP.NET, you must understand the following types of URIs thoroughly, and know how they are handled by ASP.NET and the browser.

• Absolute paths. Ex. http://mycomputer/Web1/Test/images/companylogo.png
  • ASP.NET leaves this type of path alone – it’s already in the least ambiguous form possible. Browsers understand absolute paths very well.
  • Only use these for referencing external websites. They’re expensive to maintain.
• Root-relative virtual paths. Ex. /Web1/Test/images/companylogo.png
  • ASP.NET leaves these alone too. Browsers resolve the path client-side by combining it with the domain of the parent document.
  • I don’t ever recommend hard-coding these into a website – use application-relative paths or relative paths instead. Note: These are also called “absolute virtual paths” and “domain-relative paths”.
• Application-relative paths. Ex. ~/images/companylogo.png
  • Browsers don’t have a clue what the tilde(~) means, so server-side path resolution is required. Server-side, the tilde is shorthand for HttpRuntime.AppDomainAppVirtualPath.
  • ASP.NET rebases these as client-side relative paths on some control attributes, but you must remember to use runat=”server”.
  • This is the type of path you should use if a relative path doesn’t make sense.
• Relative paths. Ex: ../images/logo.png
  • There are two types of relative paths: server-side and client-side. They aren’t syntactically different, but server-side paths are relative to the containing source file, and client-side paths are relative to the address bar or parent markup file.
  • Server-side relative paths are assumed to be relative to the containing .master, .ascx, or .aspx file location. These must be rebased into client-side relative paths when rendered using ResolveClientUrl(). Most ASP.NET controls do this for you. You should use this type of path whenever you are referencing a related file that won’t move in relation to the current file.
  • Client-side relative paths are relative to the parent URL, usually the address bar. If you want to reference an image on an html page, you must use a path that is relative to the address bar location of the html page. If you want to reference a image from within a .css file, you must use a path that is relative to the .css file. Paths inside javascript files are not relative to the javascript source location, though. They must be relative to the document the script is executing in, the address bar.
• Fragment and Javascript paths. Ex. #section2 or javascript:OpenPopup();
  • ASP.NET leaves these alone. The browser is not supposed to create a new request when one of these is clicked, but to simply perform the action or navigation within the current document.
  • Fragments never appear in a HTTP request. They are only for the browser’s benefit, and are stripped off before the path is sent to ASP.NET.

Note – When I say that ASP.NET leaves a path alone, I mean that it doesn’t do any path rebasing. ASP.NET will still do some attribute encoding on the path if it is embedded in a hyperlink.

dl{ border:1px solid #eaeaea; padding:15px; margin-top:15px; font-size:8pt; overflow:scroll; } span.querystring { color:red; }

span.pathinfo{ color:green; }

span.filepath{ color:blue }

table.rootVsSubfolder{ font-size:7.5pt; color:black;

} table.rootVsSubfolder td{ border-top: 1px solid gray; padding:5px; text-align:center; } table.rootVsSubfolder thead td{

font-weight:bold; } td.property{ border-right: 1px solid gray; padding-left:0px; } td.root{ border-right: 1px solid gray; } td.subfolder{ padding-right:0px; }

Casing and URL encoding

Casing and URL encoding add significant complexity to the jobs IIS and ASP.NET must perform. ASP.NET automatically decodes and lowercases the scheme, host, and port. The Path (and PathInfo) portions are decoded, but case is not changed. The querystring is not modified. When the querystring is parsed to populate the QueryString collection, names and values get URL decoded once.

There are an almost infinite number of ways to represent every URI – take for instance the following URIs, and how they are sanitized before your application receives them:

URL encoded scheme (http)

URI

%68%74%74%70://localhost:87/content/pages/test.aspx

Response

IIS7 returns HTTP Error 400.0 – Bad Request

Double URL encoded host

URI

http://%25%34%63%25%34%66%25%34%33%25%34%31%25%34%63%25%34%38%25%34%66%25%35%33%25%35%34:87/Content/pages/test.aspx

Response

IE7 returns “Host not found” (browser only performs one level of URL decoding, apparently)

URL Encoded host (UPPERCASE)

URI

http://%4c%4f%43%41%4c%48%4f%53%54:87/Content/pages/test.aspx

Request.Url.OriginalString

http://localhost:87/Content/pages/test.aspx

IE7 decodes the host name automatically

URL Encoding the host (lowercase)

URI

Error! Hyperlink reference not valid.

Request.Url.OriginalString

http://localhost:87/Content/pages/test.aspx

Mixed case

URI

HttP://LOcalHoSt:87/CoNtEnT/pAgEs/tEsT.asPx

Request.Url.OriginalString

http://localhost:87/CoNtEnT/pAgEs/tEsT.asPx

URLEncoding the entire URI (http://localhost:87/content/pages/test.aspx)

URI

%68%74%74%70%3a%2f%2f%6c%6f%63%61%6c%68%6f%73%74%3a%38%37%2f%63%6f%6e%74%65%6e%74%2f%70%61%67%65%73%2f%74%65%73%74%2e%61%73%70%78

Respnse

IIS7 returns HTTP Error 400.0 – Bad Request

URL Encoding the path (FilePath + PathInfo), but not the query string

URI

http://localhost/%55%72%6c%54%65%73%74%73%2f%63%6f%6e%74%65%6e%74%2f%70%61%67%65%73%2f%74%65%73%74%2e%61%73%70%78%2f%66%6f%6c%64%65%72%2f%66%69%6c%65?querystring

Request.Url.OriginalString

http://localhost:80/UrlTests/content/pages/test.aspx/folder/file?querystring

URL Encoding the path, querystring, and the “?” in-between.

URI

http://localhost/%55%72%6c%54%65%73%74%73%2f%63%6f%6e%74%65%6e%74%2f%70%61%67%65%73%2f%74%65%73%74%2e%61%73%70%78%2f%66%6f%6c%64%65%72%2f%66%69%6c%65%3f%71%75%65%72%79%73%74%72%69%6e%67

Response

Server Error in '/UrlTests' Application.
'/UrlTests/content/pages/test.aspx/folder/file?querystring' is not a valid virtual path.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Web.HttpException: '/UrlTests/content/pages/test.aspx/folder/file?querystring' is not a valid virtual path.
Source Error:
Frame1
Source File: c:\Users\Nathanael\desktop\webapplication2\Content\pages\test.aspx.cs    Line: 912308
Stack Trace:
Frame2
Version Information: Microsoft .NET Framework Version:2.0.50727.312; ASP.NET Version:2.0.50727.833

Hackers can exploit this to discover:
   If CustomErrors=false
   1.The physical location of the web site
   2.The physicial loation of the .NET framework and the
Of course, I'm sure there are other ways to generate errors - this is just one you can't patch.

Also, since the entire URL is parsed as the virtual path, it looks like this is a way to circumvent the splitting of FilePath, PathInfo, and the querystring, since the whole URL was parsed as the virtual path.

If you want the querystring to be parsed correctly, you cannot encode the delimiting question mark.

URL Encoding the path and querystring separately

URI

http://localhost/%55%72%6c%54%65%73%74%73%2f%63%6f%6e%74%65%6e%74%2f%70%61%67%65%73%2f%74%65%73%74%2e%61%73%70%78%2f%66%6f%6c%64%65%72%2f%66%69%6c%65?%71%75%65%72%79%73%74%72%69%6e%67

Request.Url.OriginalString

http://localhost:80/UrlTests/content/pages/test.aspx/folder/file?%71%75%65%72%79%73%74%72%69%6e%67

Note: HttpUtility.URLEncode() only encodes non-alphanumeric characters. You’ll have to use something else to get complete encoding, such as is used above.

So, I think you can see why basing security on the incoming path is a bad idea.

Differences between Root and Subfolder applications

IIS allows websites to be hosted in virtual folders that do not correspond to the on-disk organization. For example, if you publish a website located in C:\Websites\MyWebsite2\ on virtual folder /Web1/Test/, The URI to access it would be http://mycomputer/Web1/Test/.

The following table contains data from single web site being accessed from two different locations. One channel is the virtual folder /URLTests on port 80, and the other is the root website on port 87.

Note: CurrentExecutionFilePath (and the AppRelative version) both differ from FilePath with Server.Execute or Server.Transfer is used. CurrentExecutionFilePath changes to reflect the executing file, while FilePath remains unchanged. Spaces in the table above were inserted to allow wrapping of the text – the actual data contains no whitespace.

This should illustrate why application-relative paths (~/file.aspx) should be used wherever possible – they permit the site to be hosted in virtual folder as well as in a site root. Can you imaging the maintenance costs if you needed to move your site, and were using absolute paths, such as (/vdir/file.aspx)? You may not currently need to host the site on a virtual folder for dev purposes, but what about 5 years from now when you want to keep the old system online in a subfolder of the new site?