Skip to content

Reject ASCII control characters in cookie auth return URLs#66876

Merged
rokonec merged 3 commits into
dotnet:mainfrom
rokonec:rokonec/cookie-ishostrelative-control-chars
Jun 23, 2026
Merged

Reject ASCII control characters in cookie auth return URLs#66876
rokonec merged 3 commits into
dotnet:mainfrom
rokonec:rokonec/cookie-ishostrelative-control-chars

Share IsLocalUrl between cookie auth and SharedUrlHelper

8636c8c
Select commit
Loading
Failed to load commit list.
Azure Pipelines / aspnetcore-quarantined-pr succeeded Jun 12, 2026 in 1h 28m 14s

Build #20260609.59 had test failures

0 errors / 23 warnings

Details

Tests

  • Failed: 29 (2.33%)
  • Passed: 1,165 (93.65%)
  • Other: 50 (4.02%)
  • Total: 1,244

Annotations

Check failure on line 1 in Microsoft.AspNetCore.Hosting.FunctionalTests.LinkedApplicationTests.LinkedApplicationWorks

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.Hosting.FunctionalTests.LinkedApplicationTests.LinkedApplicationWorks 

System.Net.Http.HttpRequestException : Connection refused (localhost:40265)\n---- System.Net.Sockets.SocketException : Connection refused
Raw output 
   at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, Boolean isForHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
--- End of stack trace from previous location ---
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Server.IntegrationTesting.LoggingHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) in /_/src/Hosting/Server.IntegrationTesting/src/Common/LoggingHandler.cs:line 23
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at Microsoft.AspNetCore.Server.IntegrationTesting.RetryHelper.RetryRequest(Func`1 retryBlock, ILogger logger, CancellationToken cancellationToken, Int32 retryCount) in /_/src/Hosting/Server.IntegrationTesting/src/Common/RetryHelper.cs:line 36
   at Microsoft.AspNetCore.Server.IntegrationTesting.RetryHelper.RetryRequest(Func`1 retryBlock, ILogger logger, CancellationToken cancellationToken, Int32 retryCount)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at Microsoft.AspNetCore.Hosting.FunctionalTests.LinkedApplicationTests.LinkedApplicationWorks() in /_/src/Hosting/test/FunctionalTests/LinkedApplicationTests.cs:line 46
--- End of stack trace from previous location ---
----- Inner Stack Trace -----
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
   at System.Runtime.CompilerServices.AsyncHelpers.ValueTaskSourceContinuation.GetResult(Object source, Int16 token, Byte& result)
   at System.Runtime.CompilerServices.AsyncHelpers.ValueTaskSourceContinuation.ValueTaskSourceContinuationResume.ResumeValueTaskSourceContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken)

Check failure on line 1 in Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.HttpConnectionManagerTests.CriticalErrorLoggedIfApplicationDoesntComplete

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.HttpConnectionManagerTests.CriticalErrorLoggedIfApplicationDoesntComplete 

Assert.True() Failure
Expected: True
Actual:   False
Raw output 
   at Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.HttpConnectionManagerTests.CriticalErrorLoggedIfApplicationDoesntComplete() in /_/src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpConnectionManagerTests.cs:line 76
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.HttpConnectionManagerTests.CriticalErrorLoggedIfApplicationDoesntComplete() in /_/src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpConnectionManagerTests.cs:line 76
--- End of stack trace from previous location ---

Check failure on line 1 in Microsoft.AspNetCore.WebSockets.Test.WebSocketMiddlewareTests.PingTimeoutCancelsReceiveAsync

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.WebSockets.Test.WebSocketMiddlewareTests.PingTimeoutCancelsReceiveAsync 

System.Net.Http.HttpRequestException : An error occurred while sending the request.
---- System.IO.IOException : Unable to read data from the transport connection: Connection reset by peer.
-------- System.Net.Sockets.SocketException : Connection reset by peer
Raw output 
   at System.Net.Http.HttpConnection.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
--- End of stack trace from previous location ---
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.SocketsHttpHandler.<SendAsync>g__CreateHandlerAndSendAsync|116_0(HttpRequestMessage request, CancellationToken cancellationToken)
--- End of stack trace from previous location ---
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.GetResult[T](Task task, Byte& result)
   at System.Runtime.CompilerServices.RuntimeAsyncTaskContinuation.TaskContinuationResume.ResumeTaskContinuation(Continuation cont, Byte& result)
   at Microsoft.AspNetCore.WebSockets.Test.WebSocketMiddlewareTests.PingTimeoutCancelsReceiveAsync() in /_/src/Middleware/WebSockets/test/UnitTests/WebSocketMiddlewareTests.cs:line 841
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.WebSockets.Test.WebSocketMiddlewareTests.PingTimeoutCancelsReceiveAsync() in /_/src/Middleware/WebSockets/test/UnitTests/WebSocketMiddlewareTests.cs:line 846
--- End of stack trace from previous location ---
----- Inner Stack Trace -----
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource<System.Int32>.GetResult(Int16 token)
   at System.Runtime.CompilerServices.AsyncHelpers.ValueTaskSourceContinuation.GetResult[T](Object source, Int16 token, Byte& result)
   at System.Runtime.CompilerServices.AsyncHelpers.ValueTaskSourceContinuation.ValueTaskSourceContinuationResume.ResumeValueTaskSourceContinuation(Continuation cont, Byte& result)
   at System.Net.Http.HttpConnection.InitialFillAsync(Boolean async)
   at System.Net.Http.HttpConnection.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
----- Inner Stack Trace -----

Check failure on line 1 in Microsoft.AspNetCore.SignalR.StackExchangeRedis.Tests.RedisEndToEndTests.HubConnectionCanSendAndReceiveGroupMessages

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.SignalR.StackExchangeRedis.Tests.RedisEndToEndTests.HubConnectionCanSendAndReceiveGroupMessages 

Test failed
View more details on Azure Pipelines