SharePoint Blocked File Type & Site Names

Nunya Aynun 0 Reputation points
2023-01-31T14:15:09.1533333+00:00

After upgrading to SharePoint Server 2019 Version 16.0.10393.20000, some of our sites with only 4 letters in the site name are blocked due to the site name ending in a blocked file extension. If I remove the extension from Central Admin (ASA in the example below), then the redirect works as intended.

eg.

https://contoso.example.com/sites/CASA returns an error: "The following file(s) have been blocked by the administrator: /sites/CASA".

https://contoso.example.com/sites/CASA/ however redirects to the default.aspx as intended (note the trailing slash).

Interestingly, we have a site name that ends in INS, but is greater than 4 letters. This site redirects without issue and without a trailing slash.

Thoughts?

SharePoint Server
SharePoint Server
A family of Microsoft on-premises document management and storage systems.
2,235 questions
SharePoint
SharePoint
A group of Microsoft Products and technologies used for sharing and managing content, knowledge, and applications.
9,735 questions
SharePoint Server Management
SharePoint Server Management
SharePoint Server: A family of Microsoft on-premises document management and storage systems.Management: The act or process of organizing, handling, directing or controlling something.
2,817 questions

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Haoyan Xue_MSFT 20,186 Reputation points Microsoft Vendor
    2023-02-01T07:28:20.3466667+00:00

    Hi @Nunya Aynun ,

    Since we can't reproduce your situation, we need to narrow down the problem and try some things.

    1.Try changing the site url "CASA" to another url with a length of 4 using powershell, will there be any problems?

    $site = Get-SPSite http://MyWebApp/sites/gws1/
$site.Rename("http:// MyWebApp /sites/gws2/")

    2.Are other users facing the same problem? View through another computer or account.

    3.Whether all SharePoint sites have the same problem? You could create a new SharePoint site name with a length of 4 to check. Let me know the result please?

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  2. Nunya Aynun 0 Reputation points
    2023-02-01T13:05:37.6333333+00:00

    Thank you for the reply. Below is additional info/tests.

    All users and browsers are affected. I can quickly test by adding/removing extensions from the blocked file types in Central Admin for the Web Application that contains problematic site collection names.

    I am able to rename the title of a problematic site collection, but this does not change the URL -- which is where the issue is.

    I tested creation of site collections in different web applications using the following:

    NAME STATUS
    1ASA Fails
    CASA Fails
    1GADGET Fails
    TESTASA Works
    CASA1 Works
    ASA Works
    ASA1 Works
    CLASA Works
    GADGET Works

    SP Logs show "URL Blocked: LeafName has extension ASA" whenever an attempt fails. ASA is the example extension I used, but I have tested several other 3 letter extensions, including BAS and MAS.

    From our end, the issue is reproducible on 3 separate SharePoint farms all running the same version. The sites got created using the URLs they now have, but something in the release we upgraded to seems to have introduced or regressed back to this bug.

    0 comments
  3. Haoyan Xue_MSFT 20,186 Reputation points Microsoft Vendor
    2023-02-02T09:45:21.0333333+00:00

    Hi @Nunya Aynun ,

    I updated my answer, you can use powershell to rename the url of the problematic site collection to see if it is a specific site collection problem or an extension problem. The SP2019 version I tested was 16.0.10337.12109, and URL Blocked did not appear. But by default, several standard file extensions are blocked on Microsoft Windows SharePoint Services, including any file extensions that are treated as executable files by Windows Explorer. Files with curly braces { or } are also blocked automatically.

    The file extensions blocked by default are:

    ade, adp,app, asa, asp, bas, bat, cdx, cer, chm, class, cmd, com, cpl, crt, csh, dll, exe, fxp, hlp, hta, htr, htw, ida, idc, idq, ins, isp, its, jse, ksh, lnk, mad, maf, mag, mam, maq, mar, mas, mat, mau, mav, maw, mda, mdb, mde, mdt, mdw, mdz, msc, msi, msp, mst, ops, pcd, pif, prf, prg, printer, pst, reg, scf, scr, sct, shb, shs, shtm, shtml, stm, url, vb, vbe, vbs, wsc, wsf, wsh.

    My suggestion is that you avoid creating site collections with these extensions. Hope this can help you！

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  4. Umr 521 Reputation points
    2023-02-03T22:00:48.1466667+00:00

    After you install this security update, you may be unable to browse to a SharePoint site if the site has a blocked file type extension in the URL. For more information, see "The URL is invalid" error when you browse to a SharePoint site (KB5023406).

    https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-server-2019-january-10-2023-kb5002329-ba264f04-af58-452e-a493-422f3681ad5f

    0 comments