Skip to content

SocketsHttpHandler is missing unknown request url scheme validation on redirects #116857

Open
@MihaZupan

Description

@MihaZupan

We're validating that we're not following a redirect from https to http.

// Disallow automatic redirection from secure to non-secure schemes
if (HttpUtilities.IsSupportedSecureScheme(requestUri.Scheme) && !HttpUtilities.IsSupportedSecureScheme(location.Scheme))

We should also check that the new request url scheme is valid at all, as we do before sending the initial request

if (!HttpUtilities.IsSupportedScheme(requestUri.Scheme))
{
return new NotSupportedException(SR.Format(SR.net_http_unsupported_requesturi_scheme, requestUri.Scheme));
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions