Custom Error Page for 'Illegal Characters in path'

Question

The custom error page I set in the web.config does not get displayed when an error of "Illegal Characters in path" is raised. It does work for other server errors, so I'm not sure if there is anything I can do?

Example Request that correctly shows Custom Error Page: website.com/3f.jsp

Example Request that does not: website.com/%3f.jsp

Web.config: <customErrors mode="On" defaultRedirect="ErrorDisplay.aspx"></customErrors>

Stacktrace (customErrors Off)

[ArgumentException: Illegal characters in path.]
   System.Security.Permissions.FileIOPermission.HasIllegalCharacters(String[] str) +276
   System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) +88
   System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String[] pathList, Boolean checkForDuplicates, Boolean needFullPath) +43
   System.IO.Path.GetFullPath(String path) +82
   System.Web.HttpApplication.CheckSuspiciousPhysicalPath(String physicalPath) +19
   System.Web.Configuration.HttpConfigurationSystem.ComposeConfig(String reqPath, IHttpMapPath configmap) +175
   System.Web.HttpContext.GetCompleteConfigRecord(String reqpath, IHttpMapPath configmap) +434
   System.Web.HttpContext.GetCompleteConfig() +49
   System.Web.HttpContext.GetConfig(String name) +195
   System.Web.CustomErrors.GetSettings(HttpContext context, Boolean canThrow) +20
   System.Web.HttpResponse.ReportRuntimeError(Exception e, Boolean canThrow) +39
   System.Web.HttpRuntime.FinishRequest(HttpWorkerRequest wr, HttpContext context, Exception e) +486

I tried to manually catch the error in the Global.asax Application_Error handler, but that never gets called. Application_BeginRequest doesn't even get called when there are illegal characters, so where is IIS throwing this error and is there a way for me to display a custom page?

According to this article I may be out of luck.

Answer 1

As your stack trace shows and you observed in Application_BeginRequest not getting called, this error occurs in IIS's request handling before your application code even gets called - the answer to your first question: therefore, your Web.config and Application_Error implementation are not considered.

A related discussion on ASP.NET forums indicates as much too.

On my local IIS (7.5) server, I get back...

Bad Request - Invalid URL

HTTP Error 400. The request URL is invalid.

...for the URL http://localhost/%&what.

Curious, I tried setting a static custom error page for HTTP status code 400 under my local server's Error Pages in IIS Manager, also configuring my local server to use custom error pages for local and remote requests; but I never saw the custom error page I set for this particular error.

A TechNet article explains why:

You cannot customize the following HTTP errors: 400, 403.9, 411, 414, 500, 500.11, 500.14, 500.15, 501, 503, and 505.

So I think the answer to your second question is, no, IIS does not provide a way for you to display a custom error page for this.