UrlHelperBase.IsLocalUrl treats control characters correctly

src/Mvc/Mvc.Core/src/Routing/UrlHelperBase.cs

@@ -43,45 +43,43 @@ protected UrlHelperBase(ActionContext actionContext)
         /// <inheritdoc />
         public virtual bool IsLocalUrl(string url)
         {
-            if (string.IsNullOrEmpty(url))
+            ReadOnlySpan<char> span = url;
+
+            if (span.IsEmpty)
             {
                 return false;
             }
 
-            // Allows "/" or "/foo" but not "//" or "/\".
-            if (url[0] == '/')
+            if (span[0] == '~')
             {
-                // url is exactly "/"
-                if (url.Length == 1)
-                {
-                    return true;
-                }
-
-                // url doesn't start with "//" or "/\"
-                if (url[1] != '/' && url[1] != '\\')
-                {
-                    return true;
-                }
+                span = span[1..];
+            }
 
+            // url does not start with "/" or "~/"
+            if (span[0] != '/')
+            {
                 return false;
             }
 
-            // Allows "~/" or "~/foo" but not "~//" or "~/\".
-            if (url[0] == '~' && url.Length > 1 && url[1] == '/')
+            // url is exactly "/" or "~/"
+            if ((uint)span.Length <= 1)     // PERF: elides the bounds-check below
             {
-                // url is exactly "~/"
-                if (url.Length == 2)
-                {
-                    return true;
-                }
+                return true;
+            }
 
-                // url doesn't start with "~//" or "~/\"
-                if (url[2] != '/' && url[2] != '\\')
+            // url doesn't start with "//" or "/\"
+            if (span[1] != '/' && span[1] != '\\')
+            {
+                // check that url does not contain any (ASCII) control character
+                for (var i = 1; i < span.Length; ++i)
                 {
-                    return true;
+                    if (char.IsControl(span[i]))
+                    {
+                        return false;
+                    }
                 }
 
-                return false;
+                return true;
             }
 
             return false;

src/Mvc/Mvc.Core/test/Routing/UrlHelperTestBase.cs

@@ -288,6 +288,47 @@ public void IsLocalUrl_RejectsInvalidTokenUrls(string url)
             Assert.False(result);
         }
 
+        [Fact]
+        public void IsLocalUrl_RejectsControlCharacters()
+        {
+            // Arrange
+            var helper = CreateUrlHelper(appRoot: string.Empty, host: "www.mysite.com", protocol: null);
+
+            foreach (var controlCharacter in GetControlCharacters())
+            {
+                // Test urls like "/\n"
+                string url = $"/{controlCharacter}";
+                var result = helper.IsLocalUrl(url);
+                Assert.False(result, $"control character 0x{(int)controlCharacter:X2} in short url");
+
+                // Test urls with control character at beginning
+                url = $"/{controlCharacter}/not-local-url";
+                result = helper.IsLocalUrl(url);
+                Assert.False(result, $"control character 0x{(int)controlCharacter:X2} at beginning");
+
+                // Test urls with control character in the middle
+                url = $"/not-{controlCharacter}-local-url";
+                result = helper.IsLocalUrl(url);
+                Assert.False(result, $"control character 0x{(int)controlCharacter:X2} in the middle");
+
+                // Test urls with contorl character at the end
+                url = $"/not-local-url{controlCharacter}";
+                result = helper.IsLocalUrl(url);
+                Assert.False(result, $"control character 0x{(int)controlCharacter:X2} at the end");
+            }
+
+            static IEnumerable<char> GetControlCharacters()
+            {
+                for (var c = char.MinValue; c < 0x80; ++c)
+                {
+                    if (char.IsControl(c))
+                    {
+                        yield return c;
+                    }
+                }
+            }
+        }
+
         [Fact]
         public void RouteUrlWithDictionary()
         {