Skip to content

Conversation

@MihaZupan
Copy link
Member

Block inputs for the UriBuilder.Host setter that would "escape" the component.
Similar to #74953

This does intentionally break inputs like .Host = "host/path", "::]", user@host ...

@MihaZupan MihaZupan added this to the 11.0.0 milestone Oct 24, 2025
@MihaZupan MihaZupan self-assigned this Oct 24, 2025
@dotnet-policy-service
Copy link
Contributor

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances validation of host strings in UriBuilder to prevent malformed host inputs that could escape into other URI components. The changes add early validation to reject hosts containing problematic characters like /, ?, #, and @, while still supporting IPv6 addresses.

  • Adds a SearchValues set for efficiently detecting problematic characters in host strings
  • Implements validation logic to reject hosts with characters that could escape into path, query, or fragment components
  • Adds comprehensive test coverage for invalid host strings and their rejection behavior

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
src/libraries/System.Private.Uri/src/System/UriBuilder.cs Adds s_hostReservedChars SearchValues and implements enhanced host validation logic with special handling for IPv6 addresses
src/libraries/System.Private.Uri/tests/FunctionalTests/UriBuilderTests.cs Removes test cases with malformed IPv6 syntax, adds test for valid IPv6 zone ID, and adds comprehensive test coverage for invalid host strings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants