Skip to content

[release/9.0] Reject ASCII control characters in cookie auth return URLs#67156

Merged
rbhanda merged 4 commits into
release/9.0from
backport/pr-66876-to-release/9.0
Jun 23, 2026
Merged

[release/9.0] Reject ASCII control characters in cookie auth return URLs#67156
rbhanda merged 4 commits into
release/9.0from
backport/pr-66876-to-release/9.0

Merge branch 'release/9.0' into backport/pr-66876-to-release/9.0

6b04a98
Select commit
Loading
Failed to load commit list.
Azure Pipelines / aspnetcore-quarantined-pr succeeded Jun 23, 2026 in 1h 49m 48s

Build #20260623.97 had test failures

Details

Tests

  • Failed: 9 (0.51%)
  • Passed: 1,660 (94.80%)
  • Other: 82 (4.68%)
  • Total: 1,751

Annotations

Check failure on line 44 in .packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets#L44

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets(44,5): error : (NETCORE_ENGINEERING_TELEMETRY=Test) Test Microsoft.AspNetCore.SignalR.Client.FunctionalTests.HubConnectionTests.ChangingUserNameDuringReconnectLogsWarning has failed. Check the Test tab or this console log: https://helix.dot.net/api/2019-06-17/jobs/35ec499f-994e-42cf-87a1-2c91c59bddc9/workitems/Microsoft.AspNetCore.SignalR.Client.FunctionalTests--net9.0/console

Check failure on line 44 in .packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets#L44

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets(44,5): error : (NETCORE_ENGINEERING_TELEMETRY=Test) Test Interop.FunctionalTests.Http2.Http2RequestTests.GET_RequestReturnsLargeData_GracefulShutdownDuringRequest_RequestGracefullyCompletes has failed. Check the Test tab or this console log: https://helix.dot.net/api/2019-06-17/jobs/07e3b161-ff25-4546-944f-29a16c923710/workitems/Interop.FunctionalTests--net9.0/console

Check failure on line 44 in .packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets#L44

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets(44,5): error : (NETCORE_ENGINEERING_TELEMETRY=Test) Test Microsoft.AspNetCore.Server.HttpSys.FunctionalTests.DelegateTests.DelegateAfterReceiverRestart has failed. Check the Test tab or this console log: https://helix.dot.net/api/2019-06-17/jobs/423e3334-ff2a-47df-bde2-cdd2bd97c091/workitems/Microsoft.AspNetCore.Server.HttpSys.FunctionalTests--net9.0/console

Check failure on line 44 in .packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets#L44

.packages\microsoft.dotnet.helix.sdk\9.0.0-beta.26301.4\tools\azure-pipelines\AzurePipelines.MultiQueue.targets(44,5): error : (NETCORE_ENGINEERING_TELEMETRY=Test) Test Microsoft.AspNetCore.Server.HttpSys.ResponseBodyTests.ResponseBody_WriteContentLength_PassedThrough has failed. Check the Test tab or this console log: https://helix.dot.net/api/2019-06-17/jobs/423e3334-ff2a-47df-bde2-cdd2bd97c091/workitems/Microsoft.AspNetCore.Server.HttpSys.FunctionalTests--net9.0/console

Check failure on line 1 in Microsoft.AspNetCore.SignalR.Client.FunctionalTests.HubConnectionTests.ChangingUserNameDuringReconnectLogsWarning

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.SignalR.Client.FunctionalTests.HubConnectionTests.ChangingUserNameDuringReconnectLogsWarning

Assert.Fail(): 1 error(s) logged.
Microsoft.AspNetCore.Http.Connections.Client.Internal.WebSocketsTransport - ErrorSendingMessage - Error while sending a message.
===================
System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'System.Net.WebSockets.ClientWebSocket'.
   at System.Net.WebSockets.ClientWebSocket.get_ConnectedWebSocket()
   at System.Net.WebSockets.ClientWebSocket.SendAsync(ReadOnlyMemory`1 buffer, WebSocketMessageType messageType, Boolean endOfMessage, CancellationToken cancellationToken)
   at System.Net.WebSockets.WebSocketExtensions.SendAsync(WebSocket webSocket, ReadOnlySequence`1 buffer, WebSocketMessageType webSocketMessageType, CancellationToken cancellationToken) in /_/src/SignalR/common/Shared/WebSocketExtensions.cs:line 19
   at Microsoft.AspNetCore.Http.Connections.Client.Internal.WebSocketsTransport.StartSending(WebSocket socket, Boolean ignoreFirstCanceled) in /_/src/SignalR/clients/csharp/Http.Connections.Client/src/Internal/WebSocketsTransport.cs:line 562
===================
Raw output
   at Microsoft.AspNetCore.SignalR.Tests.VerifyNoErrorsScope.Dispose() in D:\a\_work\1\s\src\Shared\SignalR\VerifyNoErrorScope.cs:line 47
   at Microsoft.AspNetCore.SignalR.Tests.InProcessTestServer`1.DisposeAsync() in D:\a\_work\1\s\src\Shared\SignalR\InProcessTestServer.cs:line 161
   at Microsoft.AspNetCore.SignalR.Tests.InProcessTestServer`1.DisposeAsync() in D:\a\_work\1\s\src\Shared\SignalR\InProcessTestServer.cs:line 168
   at Microsoft.AspNetCore.SignalR.Client.FunctionalTests.HubConnectionTests.ChangingUserNameDuringReconnectLogsWarning() in /_/src/SignalR/clients/csharp/Client/test/FunctionalTests/HubConnectionTests.cs:line 2746
--- End of stack trace from previous location ---

Check failure on line 1 in Interop.FunctionalTests.Http2.Http2RequestTests.GET_RequestReturnsLargeData_GracefulShutdownDuringRequest_RequestGracefullyCompletes

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Interop.FunctionalTests.Http2.Http2RequestTests.GET_RequestReturnsLargeData_GracefulShutdownDuringRequest_RequestGracefullyCompletes

Test failed

Check failure on line 1 in Microsoft.AspNetCore.Server.HttpSys.FunctionalTests.DelegateTests.DelegateAfterReceiverRestart

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.Server.HttpSys.FunctionalTests.DelegateTests.DelegateAfterReceiverRestart

System.Net.Http.HttpRequestException : Response status code does not indicate success: 500 (Internal Server Error).
Raw output
   at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
   at System.Net.Http.HttpClient.GetStringAsyncCore(HttpRequestMessage request, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Server.HttpSys.FunctionalTests.DelegateTests.SendRequestAsync(String uri) in /_/src/Servers/HttpSys/test/FunctionalTests/DelegateTests.cs:line 272
   at Microsoft.AspNetCore.Server.HttpSys.FunctionalTests.DelegateTests.DelegateAfterReceiverRestart() in /_/src/Servers/HttpSys/test/FunctionalTests/DelegateTests.cs:line 263
--- End of stack trace from previous location ---

Check failure on line 1 in Microsoft.AspNetCore.Server.HttpSys.ResponseBodyTests.ResponseBody_WriteContentLength_PassedThrough

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-quarantined-pr

Microsoft.AspNetCore.Server.HttpSys.ResponseBodyTests.ResponseBody_WriteContentLength_PassedThrough

System.Net.Http.HttpRequestException : An error occurred while sending the request.
---- System.IO.IOException : Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..
-------- System.Net.Sockets.SocketException : An existing connection was forcibly closed by the remote host.
Raw output
   at System.Net.Http.HttpConnection.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
   at Microsoft.AspNetCore.Server.HttpSys.ResponseBodyTests.SendRequestAsync(String uri) in /_/src/Servers/HttpSys/test/FunctionalTests/ResponseBodyTests.cs:line 442
   at Microsoft.AspNetCore.Server.HttpSys.ResponseBodyTests.ResponseBody_WriteContentLength_PassedThrough() in /_/src/Servers/HttpSys/test/FunctionalTests/ResponseBodyTests.cs:line 223
--- End of stack trace from previous location ---
----- Inner Stack Trace -----
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)
   at System.Net.Sockets.Socket.AwaitableSocketAsyncEventArgs.System.Threading.Tasks.Sources.IValueTaskSource<System.Int32>.GetResult(Int16 token)
   at System.Net.Http.HttpConnection.InitialFillAsync(Boolean async)
   at System.Net.Http.HttpConnection.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
----- Inner Stack Trace -----