Help - Http request contains a malformed escape sequence

HCL Domino Domino Forum
1

Hi !

I’m trying to access an attachment directly by using this link: http://osl01domino/41256BA30042ED08/F87C1D34485215E7C1256C4000332C5C/F5CCC0C3D3F6353F41256DF60042A936/$File/1E2E055F1CE2800B41256BCE003B9AF1~~ALUMINIUM%20CALCIUM%2010%20%25%20WAFFLE.lwp.pdf

This worked in version 5, but the server was recently upgraded to version 6 and now it does not work anymore…

I get this error:

Http Status Code: 400

Reason: Http request contains a malformed escape sequence

Any help, tips or information on how to solve this would be greatly appreciated !!

Sincerely,

Petter Kjeilen

2

Subject: Help - Http request contains a malformed escape sequence

Your URL contains “%25” which is a hex encoded percent.

In Domino 6 the http server disallows encoded percent characters. This was done as a security measure to guard against attacks which try to mask their intent by doubly encoding characters.

In 6.0.3 you can disable this with the server notes.ini setting:

HTTPAllowDecodeUrlPercent=1

3

Subject: RE: Help - Http request contains a malformed escape sequence

Hi Mark !

Thanks for quick response !

But, does this actually mean that you cannot open an attachment directly using $File/filename if the filename contains a % character ?

For example I have this file:

ALUMINIUM STRONTIUM 10 % WIRE ROD.lwp

How would I open this ? Should I replace the % character ?

Sincerely,

Petter Kjeilen

4

Subject: RE: Help - Http request contains a malformed escape sequence

Right. You cannot open an attachment if the filename contains a % character.

You can either change the names of your attachments to not use % character, or you can get 6.0.3 and set “HTTPAllowDecodeUrlPercent=1” in your server notes.ini file.

5

Subject: Corrected .ini name

The correct ini setting is:HTTPAllowDecodedUrlPercent=1

6

Subject: RE: Corrected .ini name

Hi Mark !

ok ! Thanks a lot for your help !

Now I just have to tell the administrators to upgrade the server…

Petter

7

Subject: RE: Help - Http request contains a malformed escape sequence

Mark: thanks for your postings. I have two questions:

  1. Where is this documented?

  2. is only %25 effected?

Regards, Robert