Skip to content

Reject ASCII control characters in cookie auth return URLs#66876

Merged
rokonec merged 3 commits into
dotnet:mainfrom
rokonec:rokonec/cookie-ishostrelative-control-chars
Jun 23, 2026
Merged

Reject ASCII control characters in cookie auth return URLs#66876
rokonec merged 3 commits into
dotnet:mainfrom
rokonec:rokonec/cookie-ishostrelative-control-chars

Share IsLocalUrl between cookie auth and SharedUrlHelper

8636c8c
Select commit
Loading
Failed to load commit list.
Build Analysis / Build Analysis succeeded Jun 14, 2026 in 0s

.NET Result Analysis

Details

All checks completed

✅ [aspnetcore-ci]

✅ [aspnetcore-quarantined-pr]

✅ [aspnetcore-template-tests-pr]

Build Rerun

✔️ Build passed after 1 retries.

(Attempt #1) [link to build]

aspnetcore-ci /

[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]

Non-Deterministic Test Failures Detected

❌ Microsoft.AspNetCore.App.Analyzers.Test--net11.0.WorkItemExecution [Console] [Details] [Artifacts] [2.37% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]
This is a helix work item crash with status: BadExit. To investigate look the [Console log] / navigate to [Helix Artifacts]

Failing Configuration
❌ Microsoft.AspNetCore.Identity.EntityFrameworkCore.InMemory.Test--net11.0.WorkItemExecution [Console] [Details] [Artifacts] [1.37% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]
This is a helix work item crash with status: BadExit. To investigate look the [Console log] / navigate to [Helix Artifacts]

Failing Configuration
❌ Microsoft.AspNetCore.Server.Kestrel.Core.Tests--net11.0.WorkItemExecution [Console] [Details] [Artifacts] [1.11% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]
This is a helix work item crash with status: BadExit. To investigate look the [Console log] / navigate to [Helix Artifacts]

Failing Configuration
## Build Rerun :heavy_check_mark: Build passed after 1 retries. ### (Attempt #1) [[link to build]](https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1456774)

aspnetcore-quarantined-pr /

[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]
    ❌Step cancelled due to worker timeout

Non-Deterministic Test Failures Detected

❌ BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandalonePwaTemplate_Works(browserKind: Chromium) [Details] [87.97% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]

Failing Configuration
Exception Message
Project new blazorwasm  --no-restore --pwa failed to publish. Exit code 1.\r\nD:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\.dotnet\\dotnet.exe publish  -c Release /bl \\nStdErr: \\nStdOut:   Determining projects to restore...\r\n  All projects are up-to-date for restore.\r\nD:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\Sdks\\Microsoft.NET.Sdk\\targets\\Microsoft.NET.RuntimeIdentifierInference.targets(383,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(327,5): error MSB4216: Could not run the \"ComputeWasmBuildAssets\" task because MSBuild could not create or connect to a task host with runtime \"NET\" and architecture \"x64\".  Please ensure that (1) the requested runtime and/or architecture are available on the machine, and (2) that the required executable \"D:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\MSBuild.exe\" exists and can be run. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(346,7): error MSB4027: The \"ComputeWasmBuildAssets\" task generated invalid items from the \"AssetCandidates\" output parameter. This object is no longer valid because the MetadataLoadContext that created it has been disposed. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\n
CallStack
   at Templates.Test.Helpers.Project.RunDotNetPublishAsync(IDictionary`2 packageOptions, String additionalArgs, Boolean noRestore) in /_/src/ProjectTemplates/Shared/Project.cs:line 183
   at BlazorTemplates.Tests.BlazorTemplateTest.CreateBuildPublishAsync(String auth, String[] args, String targetFramework, Func`2 getTargetProject, Boolean onlyCreate) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorTemplateTest.cs:line 48
   at BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandalonePwaTemplate_Works(BrowserKind browserKind) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorWasmTemplateTest.cs:line 57
--- End of stack trace from previous location ---
--- End of stack trace from previous location ---
Data Driven SubResults
    ❌ Attempt# 4 - BlazorWasmStandalonePwaTemplate_Works(browserKind: Chromium)
    Exception Message
    Project new blazorwasm  --no-restore --pwa failed to publish. Exit code 1.\r\nD:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\.dotnet\\dotnet.exe publish  -c Release /bl \\nStdErr: \\nStdOut:   Determining projects to restore...\r\n  All projects are up-to-date for restore.\r\nD:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\Sdks\\Microsoft.NET.Sdk\\targets\\Microsoft.NET.RuntimeIdentifierInference.targets(383,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(327,5): error MSB4216: Could not run the \"ComputeWasmBuildAssets\" task because MSBuild could not create or connect to a task host with runtime \"NET\" and architecture \"x64\".  Please ensure that (1) the requested runtime and/or architecture are available on the machine, and (2) that the required executable \"D:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\MSBuild.exe\" exists and can be run. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(346,7): error MSB4027: The \"ComputeWasmBuildAssets\" task generated invalid items from the \"AssetCandidates\" output parameter. This object is no longer valid because the MetadataLoadContext that created it has been disposed. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.ee0rc2a3jxwb\\AspNet.ee0rc2a3jxwb.csproj]\r\n
    Stack Trace
       at Templates.Test.Helpers.Project.RunDotNetPublishAsync(IDictionary`2 packageOptions, String additionalArgs, Boolean noRestore) in /_/src/ProjectTemplates/Shared/Project.cs:line 183
   at BlazorTemplates.Tests.BlazorTemplateTest.CreateBuildPublishAsync(String auth, String[] args, String targetFramework, Func`2 getTargetProject, Boolean onlyCreate) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorTemplateTest.cs:line 48
   at BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandalonePwaTemplate_Works(BrowserKind browserKind) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorWasmTemplateTest.cs:line 57
--- End of stack trace from previous location ---
--- End of stack trace from previous location ---
❌ BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandaloneTemplate_AzureActiveDirectoryTemplate_Works [Details] [90.22% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]

Failing Configuration
Data Driven SubResults
    ❌ Attempt# 4 - BlazorWasmStandaloneTemplate_AzureActiveDirectoryTemplate_Works
❌ BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandaloneTemplate_Works(browserKind: Chromium) [Details] [86.23% failure rate]
[ 🚧 Create issue against infrastructure team] [ 📄 Create issue in this repo]

Failing Configuration
Exception Message
Project new blazorwasm  --no-restore failed to publish. Exit code 1.\r\nD:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\.dotnet\\dotnet.exe publish  -c Release /bl \\nStdErr: \\nStdOut:   Determining projects to restore...\r\n  All projects are up-to-date for restore.\r\nD:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\Sdks\\Microsoft.NET.Sdk\\targets\\Microsoft.NET.RuntimeIdentifierInference.targets(383,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(327,5): error MSB4216: Could not run the \"ComputeWasmBuildAssets\" task because MSBuild could not create or connect to a task host with runtime \"NET\" and architecture \"x64\".  Please ensure that (1) the requested runtime and/or architecture are available on the machine, and (2) that the required executable \"D:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\MSBuild.exe\" exists and can be run. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(346,7): error MSB4027: The \"ComputeWasmBuildAssets\" task generated invalid items from the \"AssetCandidates\" output parameter. This object is no longer valid because the MetadataLoadContext that created it has been disposed. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\n
CallStack
   at Templates.Test.Helpers.Project.RunDotNetPublishAsync(IDictionary`2 packageOptions, String additionalArgs, Boolean noRestore) in /_/src/ProjectTemplates/Shared/Project.cs:line 183
   at BlazorTemplates.Tests.BlazorTemplateTest.CreateBuildPublishAsync(String auth, String[] args, String targetFramework, Func`2 getTargetProject, Boolean onlyCreate) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorTemplateTest.cs:line 48
   at BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandaloneTemplate_Works(BrowserKind browserKind) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorWasmTemplateTest.cs:line 27
--- End of stack trace from previous location ---
--- End of stack trace from previous location ---
Data Driven SubResults
    ❌ Attempt# 4 - BlazorWasmStandaloneTemplate_Works(browserKind: Chromium)
    Exception Message
    Project new blazorwasm  --no-restore failed to publish. Exit code 1.\r\nD:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\.dotnet\\dotnet.exe publish  -c Release /bl \\nStdErr: \\nStdOut:   Determining projects to restore...\r\n  All projects are up-to-date for restore.\r\nD:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\Sdks\\Microsoft.NET.Sdk\\targets\\Microsoft.NET.RuntimeIdentifierInference.targets(383,5): message NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(327,5): error MSB4216: Could not run the \"ComputeWasmBuildAssets\" task because MSBuild could not create or connect to a task host with runtime \"NET\" and architecture \"x64\".  Please ensure that (1) the requested runtime and/or architecture are available on the machine, and (2) that the required executable \"D:\\a\\_work\\1\\s\\.dotnet\\sdk\\11.0.100-preview.6.26304.106\\MSBuild.exe\" exists and can be run. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\nD:\\a\\_work\\1\\s\\.packages\\Blazor\\microsoft.net.sdk.webassembly.pack\\11.0.0-preview.6.26305.101\\build\\Microsoft.NET.Sdk.WebAssembly.Browser.targets(346,7): error MSB4027: The \"ComputeWasmBuildAssets\" task generated invalid items from the \"AssetCandidates\" output parameter. This object is no longer valid because the MetadataLoadContext that created it has been disposed. [D:\\a\\_work\\1\\s\\src\\ProjectTemplates\\test\\Templates.Blazor.Tests\\bin\\Release\\net11.0\\TestTemplates\\AspNet.S1wo10fgx0xr\\AspNet.S1wo10fgx0xr.csproj]\r\n
    Stack Trace
       at Templates.Test.Helpers.Project.RunDotNetPublishAsync(IDictionary`2 packageOptions, String additionalArgs, Boolean noRestore) in /_/src/ProjectTemplates/Shared/Project.cs:line 183
   at BlazorTemplates.Tests.BlazorTemplateTest.CreateBuildPublishAsync(String auth, String[] args, String targetFramework, Func`2 getTargetProject, Boolean onlyCreate) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorTemplateTest.cs:line 48
   at BlazorTemplates.Tests.BlazorWasmTemplateTest.BlazorWasmStandaloneTemplate_Works(BrowserKind browserKind) in /_/src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorWasmTemplateTest.cs:line 27
--- End of stack trace from previous location ---
--- End of stack trace from previous location ---

Was this helpful? Yes No

View more details on Build Analysis