I have a question regarding the IIS Rewrite Module. I composed a regular expression .+/[a-zA-Zа-яА-Я0-9*~!@#$%^&s()]+/.+ and added a rule that if we enter a link with a vulnerability in the browser, such as https://localhost/Account/(A(vulnerability))/Login, it should block it and display a 404 page not found.

Why is this rule not working on IIS? I debugged the code in Visual Studio, and it receives a clean link without the vulnerability, like https://localhost/Account/Login, but visually in the browser’s address bar, it still shows https://localhost/Account/(A(vulnerability))/Login.

For testing, I created a rule that blocks a link like https://localhost/Account/Login, and it indeed not only blocked that link but also a link like https://localhost/Account/(A(vulnerability))/Login. This means that within IIS, even before processing in the Rewrite Module, the link with the vulnerability is being cleaned and turned into https://localhost/Account/Login. Therefore, the dirty link was also blocked, even though it shouldn’t have been, as it doesn’t match the regular expression.

What do you think about this, and are there any possible solutions, as I have run out of options? Thank you.