string.IsNullOrWhiteSpace accepts invalid chars

[benaadams]

string.IsNullOrWhiteSpace calls char.IsWhiteSpaceLatin1 to determine if charaters are whitespace. In addition to space (0x20) it also accepts the following as whitespace

// U+0009 = <control> HORIZONTAL TAB
// U+000a = <control> LINE FEED
// U+000b = <control> VERTICAL TAB
// U+000c = <contorl> FORM FEED
// U+000d = <control> CARRIAGE RETURN
// U+0085 = <control> NEXT LINE
// U+00a0 = NO-BREAK SPACE

They will either not be in the headers (rejected by Kestrel) or would throw an exception if used in a header. However you could currently do

response.ContentType = "\r\t\n\f" + (char)(0xa0) + (char)(0x85);

To happily remove the ContentType header; which seems a little incongruous?

More importantly it doesn't inline very well 😉

/cc @Tratcher @halter73

[benaadams]

For "text/plain" it rocks in at twice the cost of ValidateHeaderCharaters.

[benaadams]

Should it be string.IsNullOrEmpty?

[Tratcher]

There was already a bug for IsNullOrWhiteSpace somewhere, but I can't find it...

[Tratcher]

https://github.com/aspnet/HttpAbstractions/search?utf8=%E2%9C%93&q=IsNullOrWhiteSpace
I see 5 instances and I think they could all be changed to string.IsNullOrEmpty(value?.Trim()) or string.IsNullOrEmpty(value)

[benaadams]

string.Trim() calls char.IsWhiteSpaceLatin1 on both sides of the string so would be a regression, also you could still clear with a string of control characters 😢

[benaadams]

Looks like the only valid char char.IsWhiteSpace tests for is space and the others are counted as invalid/non-ascii. Depends if a tab, single cr or lf is ok as whitespace (For example in header value split by ;) though I think it will be rejected?

[benaadams]

Hmm... Kestrel will accept it on input but reject it on output.

[benaadams]

Ah, ValidateHeaderCharacters won't let them through so its just whether the contain space (0x20)