Response.Redirect sometimes ignores URL encoding

Question

On the website that I am creating now, we need a large number of dynamic redirects in order to maintain flow through parts of the site.

I am currently using response.redirect to achieve this, with the redirect URL being dynamically generated in the code behind the various button postback method.

This is normal in 95% of cases, but I notice that sometimes the URL is terribly distorted.

In one case, the URL is URLEncoded, since one of the parameters sometimes contains an ampersand, however, the redirect ignores this and redirects to the unencrypted version.

i.e. "page.aspx? qs = first% 26second & qs = 2 & qs = 3" is redirected to "page.aspx? qs = first & second & qs = 2 & qs = 3"

another case that happens is that the answer is completely devoid of ampersands, which leads to frequent failures.

i.e. "page.aspx? qs = 1 & qs = 2 & qs = 3" is redirected to "page.aspx? qs = 1qs = 2qs = 3"

Does anyone have any idea why any of these scenarios could happen?

RESOLVED

Sorry, this was due to my own idiocy, in redirecting from administrator to non-admin (don't ask), and not on re-enabling and re-encoding again on several pages.

(Facepalm)

Answer 1

I would say that the reason this happens is due to how the Response.Redirect method works internally.

Internally, the Redirect method will check the URL string parameter and, if it considers it necessary, do some encoding in the URL string parameter before the redirect actually runs.

You can find out about this by looking at the disassembly of the Response.Redirect method in Reflector. Among other things, the Redirect method does:

 url = this.ApplyRedirectQueryStringIfRequired(url); url = this.ApplyAppPathModifier(url); url = this.ConvertToFullyQualifiedRedirectUrlIfRequired(url); url = this.UrlEncodeRedirect(url); 

Each of these functions has calls for other functions, such as:

 internal static string UrlEncodeNonAscii(string str, Encoding e) internal static string UrlEncodeSpaces(string str) private static byte[] UrlEncodeBytesToBytesInternalNonAscii(byte[] bytes, int offset, int count, bool alwaysCreateReturnValue) 

Each of these functions attempts to somehow encode (or translate) the provided URL string parameter.

According to this page: Response.Redirect and encoded URIs (and others related here), there may be some problems with this encoding, depending on the input string.

It seems that the best way to avoid any encoding problems that may occur when using the Redirect method for native encoding is to explicitly encode the URL string parameter immediately before passing it to the Redirect method.

From the Response.Redirect MSDN article:

Always check and encode the URL that is passed to Response.Redirect to protect against cross-site scripting attacks. For information on how to remove harmful characters from a string, see Removing harmful characters from user input .

Please note that earlier in