Where do I set the maximum query string length? - iis

From an HTTP request with a loooong query string - 2847 in this case -, I got back error 404.15 with the following message:
Überprüfen Sie die Einstellung "configuration/system.webServer/security/requestFiltering/requestLimits#maxQueryString" in der Datei "applicationhost.config" oder "web.config".
In English:
Check the "configuration/system.webServer/security/requestFiltering/requestLimits#maxQueryString" setting in the "applicationhost.config" or "web.config" file.
I did this, by following the documentation and changing the maximum query string length from 2048 to 4096 characters.
Evidently, the above change has had an effect, as the original error message is gone.
Instead, I am now getting another error, still related to the maximum query string length. This time, it comes with HTTP code 400 and says:
Die Länge der Abfragezeichenfolge für die Anforderung überschreitet den konfigurierten maxQueryStringLength-Wert.
In English:
The query string length of the request exceeds the configured maxQueryStringLength value.
Now, I have scanned all *.config files on my entire disks for any occurrences of the substring maxQueryString. There is only one such occurrence in total, and it is the Web.config file for my IIS default website, which says
<requestLimits maxQueryString="4096" />
Hence, something else must be influencing the maximum query length - where else can this setting me configured?

first, make sure you enabled the anonymous authentication in iis:
set below code in web.config file:
<system.web>
<httpRuntime maxUrlLength="10999" maxQueryStringLength="2097151" />
……
</system.web>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxUrl="10999" maxQueryString="2097151" />
</requestFiltering>
</security>
</system.webServer>
Note: set value a little bit higher than your requirement. above mentioned is just an example.
set this value in the root folder config file. and restart iis after doing changes.

Related

iis reverse proxy rule fail with the same virtual directory

I have two urls,
the first one looks like: localhost1/api/test/2.0/aaa
the second one looks like: localhost2/api/test/3.0/aaa
when using localhost1/api/test/3.0/aaa ,I want rewrite to localhost2/api/test/3.0/aaa.
My rewrite map : original value is localhost1 and new value is localhost2
My inbound rule is api/(.+)/3.0/(.+), url match is https://{C:0}/api/{R:1}/3.0/{R:2}
When I use localhost1/api/test/3.0/aaa
I always get response from localhost1/api/test/2.0/aaa , but I really want is
localhost2/api/test/3.0/aaa
Please tell me how to fix it.
(ps: if using localhost1/api/test2/3.0/aaa , I can get the correct response from localhost2/api/test2/3.0/aaa. ,but exists locahost1/api/test)
Thanks.
As far as I know, the C:0 will match the condition pattern not the inbound pattern. Besides, I found you just write the rule to match the localhost1/api/test/3.0/aaa not the api/test/2.0/aaa.
If you want to let the 2.0 also rewrite to the localhost2, I suggest you could add below url rewrite rule.
<rule name="Teeee">
<match url="api/(.+)/2.0/(.+)" />
<action type="Rewrite" url="https://localhost2/api/{R:1}/2.0/{R:2}" />
</rule>

Is it possible to use the ${shortdate} in the internalLogFile?

Is it possible to use the ${shortdate} in the internalLogFile?
<nlog internalLogFile="C:\Logs\${shortdate}_nlog.log"
<targets>
<target name="logfile"
fileName="C:/logs/${shortdate}_dev.log"
</target>
I'm getting the expected dated logfile, but the internal log file is named ...
${shortdate}_nlog.log
Short answer: No.
Longer answer: The internal logger file name is just a string. It's read in during initialization and the XmlLoggingConfiguration class ensures that the directory exists whereas (for example) the FileTarget uses a Layout for fileName that converts the value provided using LayoutRenderers.
https://github.com/NLog/NLog/issues/581#issuecomment-74923718
My understanding from reading their comments is that the internal logging should be simple, stable, and used sparingly. Typically you are only supposed to turn it on when trying to figure out whats going wrong with your setup.
You can still dynamically name your internal log file based on the date time if you want. However it won't have the same rollover effect a target file would. It would essentially have a different datetime whenever you initialized your logger I think.
DateTime dt = DateTime.Now;
NLog.Common.InternalLogger.LogFile = #"C:\CustomLogs\NLog_Internal\internal_NLogs" + dt.ToString("yyyy-MM-dd") + ".txt";

SlowCheetah transform ignores multiple conditions

I have a WCF configuration file that I am trying to transform with SlowCheetah. For development use, we want to include the MEX endpoints, but when we release the product, these endpoints should be removed on all services except one. The server for which it should be left has the following endpoint:
<endpoint address="MEX"
binding="mexHttpBinding"
contract="IMetadataExchange" />
The ones that should be removed are as follows:
<endpoint address="net.tcp://computername:8001/WCFAttachmentService/MEX"
binding="netTcpBinding"
bindingConfiguration="UnsecureNetTcpBinding"
name="WCFAttachmentServiceMexEndpoint"
contract="IMetadataExchange" />
The transform I am using is:
<service>
<endpoint xdt:Locator="Condition(contains(#address, 'MEX') and not(contains(#binding, 'mexHttpBinding')))" xdt:Transform="RemoveAll" />
</service>
However, when I run this, ALL MEX endpoints are removed from the config file including the one that I wish to keep. How do I make this work properly?
The Locator Condition expression that selects the nodes seems to be correct. If you had only the two endpoints you posted in your example, this expression will select the second endpoint.
According to the documentation the Transform attribute RemoveAll should "remove the selected element or elements." Based on the information you posted it's not working as expected, since the first element was not selected and was removed anyway. Based on this StackOverflow answer it seems to me that the issue is with Condition. I'm not sure if that's a bug (it's poorly documented), but you could try some alternative solutions:
1) Using XPath instead of Condition. The effective XPath expression that is applied to your configuration file as a result of the Condition expression is:
/services/service/endpoint[contains(#address, 'MEX') and not(contains(#binding, 'mexHttpBinding'))]
You should also obtain the same result using the XPath attribute instead of Condition:
<endpoint xdt:Locator="XPath(/services/service/endpoint[contains(#address, 'MEX')
and not(contains(#binding, 'mexHttpBinding'))])" xdt:Transform="RemoveAll" />
2) Using Match and testing an attribute such as binding. This is a simpler test, and would be IMO the preferred way to perform the match. You could select the nodes you want to remove by the binding attribute
<endpoint binding="netTcpBinding" xdt:Locator="Match(binding)" xdt:Transform="RemoveAll" />
3) UsingXPath instead of Match in case you have many different bindings and only want to eliminate only those which are not mexHttpBinding:
<endpoint xdt:Locator="XPath(/services/service/endpoint[not(#binding='mexHttpBinding'))" xdt:Transform="RemoveAll" />
4) Finally, you could try using several separate statements with Condition() or Match() to individually select the <endpoint> elements you wish to remove, and use xdt:Transform="Remove" instead of RemoveAll.

OSSEC | How to add an exception rule

I have the standard syslog_rules.xml (OSSEC 2.6.0).
This is the standard rule for bad words in the /var/log/messages file:
<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>
.....
<rule id="1002" level="2">
<match>$BAD_WORDS</match>
<options>alert_by_email</options>
<description>Unknown problem somewhere in the system.</description>
</rule>
.....
How can I add or modify this rule that uses $BAD_WORDS, but excludes the auxpropfunc error phrase? That is, something like this:
<match>$BAD_WORDS</match>
<match>!auxpropfunc error</match>
<options>alert_by_email</options>
Any ideas?
Your best option is probably to write a rule to ignore that phrase. You could add something like the following to /var/ossec/rules/local_rules.xml:
<rule id="SOMETHING" level="0">
<if_sid>1002</if_sid>
<match>auxpropfunc error</match>
<description>Ignore auxpropfunc error.</description>
</rule>
You could then run the entire log message through ossec-logtest to see how OSSEC will analyze it. You may need to add another option into this rule, or you may not.
If you have more than one word, you could add something like the following to /var/ossec/rules/local_rules.xml
<var name="GOOD_WORDS">error_reporting|auxpropfunc error</var>
<rule id="100002" level="0">
<if_sid>1002</if_sid>
<match>$GOOD_WORDS</match>
<description>Ignore good_words.</description>
</rule>

Parsing Tableau xml does not preserve original file

I try to work programmatically on Tableau desktop file (which are just xml file in spite of their .twb extension). I have many problem with lxml which doesn't preserve original content. To facilitate the explanation, imagine you have a test.xml file which contain the following text:
<column caption='Choix Découpage' name='[Aujourd&apos;Hui Parameter (copy 2)]'>
<member name='Nb d&apos;annulations' default-format='n#,##0.00" annulations";-#,##0.00" annulations"' />
<run>
:</run>
<calculation formula='iif([FAC_TYPE] = &apos;Avoir&apos; , [Calculation_1378101492427309057], null)' />
<alias key='"Billetterie Ferroviaire"' value='Train ticketing' />
</column>
Now let's parse it:
tree = etree.parse('test.xml')
root = tree.getroot()
print(etree.tostring(root,pretty_print=True,).decode("utf-8"))
When you run the code we can notice:
' becomes "
é becomes é Edit: resolved for this part
&apos; becomes '
How could i preserve the original ? (It would help me a lot when i try to check the diff with git in spite of showing all the useless change that are operated automatically)
Edit: I notice an other problem, when i run the folowing code:
[node.attrib['key'] for node in root.xpath("//alias")]
I got the result: ['"Billetterie Ferroviaire"'] and I am now unable to query with xpath if i am looking for the node whose attribute "key" is the original "Billetterie Ferroviaire" (root.xpath('//[#key="Billetterie Ferroviaire"]) doesn't work)

Resources