-
Notifications
You must be signed in to change notification settings - Fork 5.2k
Add some validation to UriBuilder.Host setter #121083
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
|
Tagging subscribers to this area: @dotnet/ncl |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR enhances validation of host strings in UriBuilder to prevent malformed host inputs that could escape into other URI components. The changes add early validation to reject hosts containing problematic characters like /, ?, #, and @, while still supporting IPv6 addresses.
- Adds a
SearchValuesset for efficiently detecting problematic characters in host strings - Implements validation logic to reject hosts with characters that could escape into path, query, or fragment components
- Adds comprehensive test coverage for invalid host strings and their rejection behavior
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/libraries/System.Private.Uri/src/System/UriBuilder.cs | Adds s_hostReservedChars SearchValues and implements enhanced host validation logic with special handling for IPv6 addresses |
| src/libraries/System.Private.Uri/tests/FunctionalTests/UriBuilderTests.cs | Removes test cases with malformed IPv6 syntax, adds test for valid IPv6 zone ID, and adds comprehensive test coverage for invalid host strings |
src/libraries/System.Private.Uri/tests/FunctionalTests/UriBuilderTests.cs
Outdated
Show resolved
Hide resolved
a8a3ea7 to
8586ab2
Compare
Block inputs for the
UriBuilder.Hostsetter that would "escape" the component.Similar to #74953
This does intentionally break inputs like
.Host = "host/path","::]",user@host...