Skip to content

Harden UrlHelperBase.IsLocalUrl against control characters #18109

@pranavkm

Description

@pranavkm

UrlHelperBase.IsLocalUrl will return true for urls such as /\n/not-local-url. Using this value as part of LocalRedirectResult will result in an exception from HttpAbstractions rather than the more helpful error message from LocalRedirectResultExecutor: https://github.com/aspnet/AspNetCore/blob/master/src/Mvc/Mvc.Core/src/Infrastructure/LocalRedirectResultExecutor.cs#L53

Metadata

Metadata

Assignees

Labels

DoneThis issue has been fixedarea-mvcIncludes: MVC, Actions and Controllers, Localization, CORS, most templatesbugThis issue describes a behavior which is not expected - a bug.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions