get an unencoded url from Url Rewrite IIS module

src/config/iisnode_dev_x64.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_dev_x86_on_x64.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_dev_x86_on_x86.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_express_schema.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_express_schema_x64.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_schema.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/config/iisnode_schema_x64.xml

@@ -60,5 +60,6 @@ Details at http://learn.iis.net/page.aspx/241/configuration-extensibility/
     <attribute name="configOverrides" type="string" expanded="true" defaultValue="iisnode.yml"/>
     <attribute name="recycleSignalEnabled" type="bool" defaultValue="false"/>
     <attribute name="idlePageOutTimePeriod" type="uint" defaultValue="0" /> <!-- disabled with default value 0 -->
+    <attribute name="useUnencodedRequestUrl" type="bool" defaultValue="false"/>
   </sectionSchema>
 </configSchema>

src/iisnode/cmoduleconfiguration.cpp

@@ -33,7 +33,8 @@ CModuleConfiguration::CModuleConfiguration()
       debuggerVirtualDirPhysicalPath(NULL),
       recycleSignalEnabled(FALSE),
       debuggerExtensionDll(NULL),
-      idlePageOutTimePeriod(0)
+      idlePageOutTimePeriod(0),
+      useUnencodedRequestUrl(FALSE)
 {
     InitializeSRWLock(&this->srwlock);
 }
@@ -870,6 +871,10 @@ HRESULT CModuleConfiguration::ApplyConfigOverrideKeyValue(IHttpContext* context,
     {
         CheckError(GetDWORD(valueStart, &config->idlePageOutTimePeriod));
     }
+    else if (0 == strcmpi(keyStart, "useUnencodedRequestUrl"))
+    {
+        CheckError(GetBOOL(valueStart, &config->useUnencodedRequestUrl));
+    }
 
     return S_OK;
 Error:
@@ -1229,6 +1234,7 @@ HRESULT CModuleConfiguration::GetConfig(IHttpContext* context, CModuleConfigurat
         CheckError(GetString(section, L"nodeProcessCommandLine", &c->nodeProcessCommandLine));
         CheckError(GetString(section, L"interceptor", &c->interceptor));
         CheckError(GetDWORD(section, L"idlePageOutTimePeriod", &c->idlePageOutTimePeriod));
+        CheckError(GetBOOL(section, L"useUnencodedRequestUrl", &c->useUnencodedRequestUrl, FALSE));
 
         // debuggerPathSegment
 
@@ -1470,6 +1476,11 @@ LPWSTR CModuleConfiguration::GetConfigOverrides(IHttpContext* ctx)
     GETCONFIG(configOverrides)
 }
 
+BOOL CModuleConfiguration::GetUseUnencodedRequestUrl(IHttpContext * ctx)
+{
+    GETCONFIG(useUnencodedRequestUrl);
+}
+
 HRESULT CModuleConfiguration::GenerateDebuggerConfig(IHttpContext* context, CModuleConfiguration *config)
 {
     HRESULT hr = S_OK;
@@ -1558,12 +1569,12 @@ HRESULT CModuleConfiguration::GetDebuggerFilesPathSegmentHelper(
     DWORD  *pdwDebuggerFilesPathSegmentSize
 )
 {
-    HRESULT         hr = S_OK;
-    HCRYPTPROV      hProv = 0;
+    HRESULT         hr = S_OK;
+    HCRYPTPROV      hProv = 0;
     HCRYPTHASH      hHash = 0;
     CHAR            rgbDigits[] = "0123456789abcdef";
-    BYTE            rgbHash[32]; // sha256 ==> 32 bytes.
-    DWORD           cbHash = 0;
+    BYTE            rgbHash[32]; // sha256 ==> 32 bytes.
+    DWORD           cbHash = 0;
     CHAR            shaHash[MAX_HASH_CHAR + 1]; // we will only use first MAX_HASH_CHAR bytes of the sha256 hash ==> 32 hex chars.
     DWORD           dwSHALength = 0;
     CHAR           *pInput = NULL; 
@@ -1581,27 +1592,27 @@ HRESULT CModuleConfiguration::GetDebuggerFilesPathSegmentHelper(
     ErrorIf(dwInputSize != WideCharToMultiByte(CP_ACP, 0, pszScriptPath, dwScriptPathLen, pInput, dwInputSize, NULL, NULL), E_FAIL);
     pInput[dwInputSize] = '\0';
 
-    // Get handle to the crypto provider
-    ErrorIf(!CryptAcquireContext(&hProv,
-                                 NULL,
-                                 NULL,
-                                 PROV_RSA_AES,
-                                 CRYPT_VERIFYCONTEXT), HRESULT_FROM_WIN32(GetLastError()));
-
+    // Get handle to the crypto provider
+    ErrorIf(!CryptAcquireContext(&hProv,
+                                 NULL,
+                                 NULL,
+                                 PROV_RSA_AES,
+                                 CRYPT_VERIFYCONTEXT), HRESULT_FROM_WIN32(GetLastError()));
+
     ErrorIf(!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash), HRESULT_FROM_WIN32(GetLastError()));
 
     ErrorIf(!CryptHashData(hHash, (BYTE*) pInput, strnlen_s(pInput, dwInputSize), 0), HRESULT_FROM_WIN32(GetLastError()));
 
     // sha256 ==> 32 bytes.
-    cbHash = 32;
-    ErrorIf(!CryptGetHashParam(hHash, HP_HASHVAL, rgbHash, &cbHash, 0), HRESULT_FROM_WIN32(GetLastError()));
-
-    dwIndex = 0;
-    // convert first (MAX_HASH_CHAR / 2) bytes to hexadecimal form.
-    for (DWORD i = 0; i < (MAX_HASH_CHAR / 2); i++, dwIndex=dwIndex+2)
-    {
-        shaHash[dwIndex] = rgbDigits[rgbHash[i] >> 4];
-        shaHash[dwIndex+1] = rgbDigits[rgbHash[i] & 0xf];
+    cbHash = 32;
+    ErrorIf(!CryptGetHashParam(hHash, HP_HASHVAL, rgbHash, &cbHash, 0), HRESULT_FROM_WIN32(GetLastError()));
+
+    dwIndex = 0;
+    // convert first (MAX_HASH_CHAR / 2) bytes to hexadecimal form.
+    for (DWORD i = 0; i < (MAX_HASH_CHAR / 2); i++, dwIndex=dwIndex+2)
+    {
+        shaHash[dwIndex] = rgbDigits[rgbHash[i] >> 4];
+        shaHash[dwIndex+1] = rgbDigits[rgbHash[i] & 0xf];
     }
 
     shaHash[dwIndex] = '\0';

src/iisnode/cmoduleconfiguration.h

@@ -52,6 +52,7 @@ class CModuleConfiguration : public IHttpStoredContext
     static BOOL invalid;
     SRWLOCK srwlock;
     LPWSTR configOverrides;
+    BOOL useUnencodedRequestUrl;
 
     static IHttpServer* server;
     static HTTP_MODULE_ID moduleId;
@@ -129,6 +130,7 @@ class CModuleConfiguration : public IHttpStoredContext
     static BOOL GetEnableXFF(IHttpContext* ctx);
     static HRESULT GetPromoteServerVars(IHttpContext* ctx, char*** vars, int* count);
     static LPWSTR GetConfigOverrides(IHttpContext* ctx);
+    static BOOL GetUseUnencodedRequestUrl(IHttpContext* ctx);
 
     static HRESULT CreateNodeEnvironment(IHttpContext* ctx, DWORD debugPort, PCH namedPipe, PCH signalPipeName, PCH* env);
 

src/iisnode/cprotocolbridge.cpp

@@ -492,9 +492,22 @@ HRESULT CProtocolBridge::InitiateRequest(CNodeHttpStoredContext* context)
 
         PCSTR url;
         USHORT urlLength;
-        IHttpRequest* request = context->GetHttpContext()->GetRequest();
+        IHttpContext* httpContext = context->GetHttpContext();
+        IHttpRequest* request = httpContext->GetRequest();
 
-        if (NULL == (url = request->GetHeader("X-Original-URL", &urlLength)))
+        DWORD unencodedUrlLength;
+        if (CModuleConfiguration::GetUseUnencodedRequestUrl(httpContext) && 
+            S_OK == httpContext->GetServerVariable("UNENCODED_URL", &url, &unencodedUrlLength))
+        {
+            urlLength = static_cast<USHORT>(unencodedUrlLength);
+        }
+
+        if (NULL == url)
+        {
+            url = request->GetHeader("X-Original-URL", &urlLength);
+        }
+
+        if (NULL == url)
         {
             HTTP_REQUEST* raw = request->GetRawHttpRequest();
 

src/samples/configuration/iisnode.yml

@@ -136,6 +136,12 @@ flushResponse: false
 
 enableXFF: false
 
+# useUnencodedRequestUrl - controls whether iisnode gets request url from X-Original-URL server variable that gets sanitized by http.sys
+# or from UNENCODED_URL, which represents an exact original url. Using the latter option means that the application itself will be
+# responsible for possible security issues
+
+useUnencodedRequestUrl: false
+
 # promoteServerVars - comma delimited list of IIS server variables that will be propagated to the node.exe process in the form of
 # x-iisnode-<server_variable_name>
 # HTTP request headers; for a list of IIS server variables available see

src/samples/configuration/readme.htm

@@ -133,6 +133,10 @@ <h2>
 
     * enableXFF - controls whether iisnode adds or modifies the X-Forwarded-For request HTTP header with the IP address of the remote host
 
+    * useUnencodedRequestUrl - controls whether iisnode gets request url from X-Original-URL server variable that gets sanitized by
+      http.sys or from UNENCODED_URL, which represents an exact original url. Using the latter option means that the application itself
+      will be responsible for possible security issues
+
     * promoteServerVars - comma delimited list of IIS server variables that will be propagated to the node.exe process in the form of 
       x-iisnode-&lt;server_variable_name&gt; HTTP request headers; for a list of IIS server variables available see 
       http://msdn.microsoft.com/en-us/library/ms524602(v=vs.90).aspx; for example "AUTH_USER,AUTH_TYPE"
@@ -173,6 +177,7 @@ <h2>
       devErrorsEnabled="true"
       flushResponse="false"
       enableXFF="false"
+      useUnencodedRequestUrl="false"
       promoteServerVars=""
       configOverrides="node.conf"
      /&gt;
@@ -330,6 +335,12 @@ <h2>
 
 enableXFF: false
 
+# useUnencodedRequestUrl - controls whether iisnode gets request url from X-Original-URL server variable that gets sanitized by http.sys
+# or from UNENCODED_URL, which represents an exact original url. Using the latter option means that the application itself will be
+# responsible for possible security issues
+
+useUnencodedRequestUrl: false
+
 # promoteServerVars - comma delimited list of IIS server variables that will be propagated to the node.exe process in the form of
 # x-iisnode-&lt;server_variable_name&gt;
 # HTTP request headers; for a list of IIS server variables available see

src/samples/configuration/web.config

@@ -97,7 +97,11 @@
       CPU cost but may improve latency in streaming scenarios
 
     * enableXFF - controls whether iisnode adds or modifies the X-Forwarded-For request HTTP header with the IP address of the remote host
-
+
+    * useUnencodedRequestUrl - controls whether iisnode gets request url from X-Original-URL server variable that gets sanitized by
+      http.sys or from UNENCODED_URL, which represents an exact original url. Using the latter option means that the application itself
+      will be responsible for possible security issues
+
     * promoteServerVars - comma delimited list of IIS server variables that will be propagated to the node.exe process in the form of 
       x-iisnode-<server_variable_name> HTTP request headers; for a list of IIS server variables available see 
       http://msdn.microsoft.com/en-us/library/ms524602(v=vs.90).aspx; for example "AUTH_USER,AUTH_TYPE"
@@ -138,6 +142,7 @@
       devErrorsEnabled="true"
       flushResponse="false"      
       enableXFF="false"
+      useUnencodedRequestUrl="false"
       promoteServerVars=""
       configOverrides="iisnode.yml"
      />