We're working on hardening our SharePoint server, and STIG V-76825 IISW-SI-000229 mandates that "Double encoded URL requests must be prohibited by any IIS 8.5 website". Basically, editing the
Request Filtering feature settings in IIS and unchecking the
Allow double escaping checkbox.
Is this going to limit any SharePoint operations, considering the
source parameter is escaped and used in a lot of operations? Or things like document names?
I've done a little testing, but I don't have a way to test every possible SharePoint url, and I haven't found a definitive answer searching the internet yet. If we need to leave it checked, I have to have some good documentation as to why.