asp.net – 绕过路径遍历过滤器

在我的Web应用程序中,我删除这些字符：

( <,>,:,”,/,\,|,?,* )

从我的文件下载网址,以防止路径遍历.

有没有办法绕过这个？

它安全吗？

解决方法

请查看以下指南： http://msdn.microsoft.com/en-us/library/ff647397.aspx,但问题的相关部分将在下面突出显示.

If you must accept file names as input,use the full name of the file by using System.IO.Path.GetFileName.

如果您想进一步保护您的网站：

Using Code Access Security to Restrict File I/O
An administrator can restrict an application’s file I/O to its own virtual directory hierarchy by configuring the application to run with Medium trust. In this event,.NET code access security ensures that no file access is permitted outside of the application’s virtual directory hierarchy.

You configure an application to run with Medium trust by setting the element in Web.config or Machine.config.
<trust level="Medium" />