Why is "parent path" not allowed on IIS7/IIS8? Why do I get an error with disallowed parent path?

Parent path is not allowed on iis7 and an error with disallowed parent path will appear


Parent path is not allowed on iis7 to prevent people from doing forbidden things. Below you will find a quote from microsoft:

"Parent paths can potentially be a security vulnerability if a path is escaped. It would also depend on how your site content is structured."
"The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the .. otation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application."

Use a virtual path.


This is an example of a parent path:
Relative parent paths in include statements use the following form:
<!--#include file="../<filename.ext>"-->


This is an example of a virtual path:
The syntax example below illustrates how to implement virtual paths:
<!--#include virtual="/<virtual path>/<filename.ext>"-->

<!--#include file="../Index2/page_2.asp" -->

Error that will appear:


Active Server Pages error ’ASP 0131’
Disallowed Parent Path
/index/page_1.asp, line 11
The Include file ’../Index2/page_2.asp’ cannot contain ’..’ to indicate the parent directory.

You need to replace this line with:
<!--#include virtual="/Index2/page_2.asp"-->

Article Number: 1811
Posted: Thu, Jun 16, 2011 2:05 PM
Last Updated: Tue, Oct 8, 2019 2:15 PM
Posted: Nick Corne [nick.corne@hostbasket.com]

Online URL: https://onlinehelp.cloud.telenet.be/article.php?id=1811