ASP.NET: Cannot use a leading .. to exit above the top directory

image

This is a really quick post, mostly for myself so the next time I have this issue I can find the answer (yes, I often search my blog before google).

The error “Cannot use a leading .. to exit above the top directory” can be thrown by ASP.NET when you use relative paths incorrectly.  If you generate a url with too many “../../../” levels in it that would take the user above the root directory, you can generate the exception.

Why the exception?  Security I guess, but it’s a client URL and the server should know better than let the internet walk the C drive, but at one time a company in Redmond had servers with just such issues.  My problem isn’t with the unneeded exception (after all, it would just be a 404 link worst case), but with the bug in ASP.NET that causes it.

If you are using Server.Transfer or HttpContext.RewritePath to redirect a request (say map it to a template page) and have a HyperLink control with the ImageUrl property set, you win an extra “../” by the framework.  The fix is to wrap the HyperLink control around an Image control. 

In code, if you have:

<asp:HyperLink runat="server" NavigateUrl="~/FlyPage.aspx"
    ImageUrl="~/Images/DeadFly.png" Width="200" Height="200"/>

Change it to:

<asp:HyperLink runat="server" NavigateUrl="~/FlyPage.aspx">
    <asp:Image runat="server" ImageUrl="~/Images/DeadFly.png"
    Width="200" Height="200" />
</asp:HyperLink>

(I said it was a quick post… now go register for CodeStock!)

Posted By Mike On Friday, March 12, 2010
Filed under asp.net | No Comments

Submit this story to DotNetKicks   

Leave a comment



Your name:
 

Your email (not shown):
 
Will display your Gravatar image.

Your website (optional):



About Michael

Michael C. Neel, born 1976 in Houston, TX and now live in Knoxvile, TN. Software developer, currently .Net focused. Board member of ETNUG and organizes CodeStock, East Tennessee's annual developers conference. .Net speaker, a Microsoft ASP.NET MVP and ASPInsider. Co-Founder of FuncWorks, LLC and GameMarx.

Proud father of two amazing girls, Rachel and Hannah, and loving husband to Cicelie who inflates and pops his ego as necessary.

 Subscribe to ViNull.com |  Comments

Follow me on Twitter | Contact Me

Related Posts

ASP.NET: Creating a UserControl with Child Content

I love ASP.NET User Controls, aka “ascx” files.  These little guys are great for reusable content and dividing up the components of a website.  ... Read more

ASP.NET SEO Interview on Polymorphic Podcast

Craig Shoemaker just posted the latest episode of the Polymorphic Podcast: ASP.NET SEO - Interview with Michael Neel.  Yes, I've now appeared in a ... Read more

Google Can You Hear Me?

In June of 2006 I wrote an article titled "Google Can You Hear Me? How to design URLs that are search engine friendly" that also included a sidebar titled ... Read more

Using LINQ to generate HTML

I hate seeing code mixed with markup. Seeing a template page with <% if(show) { %> makes me want to claw my eyes out.  Seeing String htmlTitle ... Read more

The ASP.NET MVC Definition

A few days ago I posted a question to the community, looking for a definition of the ASP.NET MVC framework that didn't depend upon faults in ASP.NET WebForms ... Read more

XNA 3D Primer by Michael C. Neel

XNA 3D Primer by Michael C. Neel
Buy Now: [ Amazon ] [ Wrox ]

GameMarx

CodeStock

ASPInsiders Member

ETNUG Member