Skip to content

[release/9.0] Reject ASCII control characters in cookie auth return URLs#67156

Merged
rbhanda merged 4 commits into
release/9.0from
backport/pr-66876-to-release/9.0
Jun 23, 2026
Merged

[release/9.0] Reject ASCII control characters in cookie auth return URLs#67156
rbhanda merged 4 commits into
release/9.0from
backport/pr-66876-to-release/9.0

Merge branch 'release/9.0' into backport/pr-66876-to-release/9.0

6b04a98
Select commit
Loading
Failed to load commit list.
Azure Pipelines / aspnetcore-components-e2e succeeded Jun 23, 2026 in 1h 0m 16s

Build #20260623.78 had test failures

1 errors / 4 warnings

Details

Tests

  • Failed: 10 (0.71%)
  • Passed: 1,396 (99.22%)
  • Other: 1 (0.07%)
  • Total: 1,407

Annotations

Check failure on line 240104 in Build log

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-components-e2e

Build log #L240104 

Bash exited with code '1'.

Check failure on line 1 in Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(id: "afterrender-async-throw")

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-components-e2e

Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(id: "afterrender-async-throw") 

OpenQA.Selenium.ElementClickInterceptedException : element click intercepted: Element <button id="afterrender-async-throw">...</button> is not clickable at point (189, 430). Other element would receive the click: <div id="blazor-error-ui" style="display: block;">...</div>
  (Session info: chrome=149.0.7827.155)
Raw output 
   at OpenQA.Selenium.WebDriver.UnpackAndThrowOnError(Response errorResponse, String commandToExecute)
   at OpenQA.Selenium.WebDriver.ExecuteAsync(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebDriver.InternalExecute(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Execute(String commandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Click()
   at Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(String id) in /home/vsts/work/1/s/src/Components/test/E2ETest/Tests/CircuitTests.cs:line 51
   at InvokeStub_CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(Object, Span`1)
   at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)

Check failure on line 1 in Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentDisposeMethodThrowsExceptionTerminatesTheCircuit

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-components-e2e

Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentDisposeMethodThrowsExceptionTerminatesTheCircuit 

OpenQA.Selenium.ElementClickInterceptedException : element click intercepted: Element <button id="dispose-throw">...</button> is not clickable at point (476, 430). Other element would receive the click: <div id="blazor-error-ui" style="display: block;">...</div>
  (Session info: chrome=149.0.7827.155)
Raw output 
   at OpenQA.Selenium.WebDriver.UnpackAndThrowOnError(Response errorResponse, String commandToExecute)
   at OpenQA.Selenium.WebDriver.ExecuteAsync(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebDriver.InternalExecute(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Execute(String commandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Click()
   at Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentDisposeMethodThrowsExceptionTerminatesTheCircuit() in /home/vsts/work/1/s/src/Components/test/E2ETest/Tests/CircuitTests.cs:line 73
   at InvokeStub_CircuitTests.ComponentDisposeMethodThrowsExceptionTerminatesTheCircuit(Object, Object, IntPtr*)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)

Check failure on line 1 in Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(id: "afterrender-sync-throw")

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-components-e2e

Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(id: "afterrender-sync-throw") 

OpenQA.Selenium.ElementClickInterceptedException : element click intercepted: Element <button id="afterrender-sync-throw">...</button> is not clickable at point (405, 414). Other element would receive the click: <div id="blazor-error-ui" style="display: block;">...</div>
  (Session info: chrome=149.0.7827.155)
Raw output 
   at OpenQA.Selenium.WebDriver.UnpackAndThrowOnError(Response errorResponse, String commandToExecute)
   at OpenQA.Selenium.WebDriver.ExecuteAsync(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebDriver.InternalExecute(String driverCommandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Execute(String commandToExecute, Dictionary`2 parameters)
   at OpenQA.Selenium.WebElement.Click()
   at Microsoft.AspNetCore.Components.E2ETest.ServerExecutionTests.CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(String id) in /home/vsts/work/1/s/src/Components/test/E2ETest/Tests/CircuitTests.cs:line 51
   at InvokeStub_CircuitTests.ComponentLifecycleMethodThrowsExceptionTerminatesTheCircuit(Object, Span`1)
   at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)

Check failure on line 1 in Microsoft.AspNetCore.Components.E2ETest.Tests.FormsInputDateTest.InputDateInteractsWithEditContext_NonNullableDateTime

See this annotation in the file changed.

@azure-pipelines azure-pipelines / aspnetcore-components-e2e

Microsoft.AspNetCore.Components.E2ETest.Tests.FormsInputDateTest.InputDateInteractsWithEditContext_NonNullableDateTime 

OpenQA.Selenium.BrowserAssertFailedException : Xunit.Sdk.EqualException: Assert.Equal() Failure
Expected: modified valid
Actual:   modified invalid
   at Xunit.Assert.Equal[T](T expected, T actual, IEqualityComparer`1 comparer) in /_/src/xunit.assert/Asserts/EqualityAsserts.cs:line 96
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.<>c__DisplayClass17_0.<WaitAssertCore>b__0() in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 83
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.<>c__DisplayClass18_0`1.<WaitAssertCore>b__0(IWebDriver _) in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 101
Screen shot captured at '/home/vsts/work/1/s/src/Components/test/E2ETest/bin/screenshots/9c7a1162185342ed8ccf1b3ce1083552.png'
Page content:
<head>
    <meta charset="utf-8">
    
    <base href="/subdir/">
    <link href="style.css" rel="stylesheet">
    <link rel="icon" href="data:,">

    <!-- Used by ExternalContentPackage -->
    <link href="_content/TestContentPackage/styles.css" rel="stylesheet">

    <!-- App bundle that contains a reference to the scoped css bundle created by TestContentPackage -->
    <link href="BasicTestApp.styles.css" rel="stylesheet">
<!--!--><!--!--><!--!--><title>Basic test app</title><!--!--><!--!--><!--!--></head>

<body>
    <root><div id="test-selector"><!--!-->
    Select test:
    <select id="test-selector-select"><option value="none">Choose...</option><!--!-->
        <option value="BasicTestApp.AddRemoveChildComponents">Add/remove child components</option><!--!-->
        <option value="BasicTestApp.AfterRenderInteropComponent">After-render interop component</option><!--!-->
        <option value="BasicTestApp.AsyncEventHandlerComponent">Async event handlers</option><!--!-->
        <option value="BasicTestApp.AuthTest.AuthRouter">Auth cases</option><!--!-->
        <option value="BasicTestApp.AuthTest.CascadingAuthenticationStateParent">Cascading authentication state</option><!--!-->
        <option value="BasicTestApp.BindCasesComponent">bind cases</option><!--!-->
        <option value="BasicTestApp.CascadingValueTest.CascadingValueSupplier">Cascading values</option><!--!-->
        <option value="Components.TestServer.CircuitContextComponent">Circuit context</option><!--!-->
        <option value="BasicTestApp.ComponentRefComponent">Component ref component</option><!--!-->
        <option value="BasicTestApp.ConcurrentRenderParent">Concurrent rendering</option><!--!-->
        <option value="BasicTestApp.ConfigurationComponent">Configuration</option><!--!-->
        <option value="BasicTestApp.ConfigureRuntime">Configure runtime</option><!--!-->
        <option value="BasicTestApp.ContentEditable">Content-editable</option><!--!-->
        <option value="BasicTestApp.CounterComponent">Counter</option><!--!-->
        <option value="BasicTestApp.CounterComponentUsingChild">Counter using child component</option><!--!-->
        <option value="BasicTestApp.CounterComponentWrapper">Counter wrapped in parent</option><!--!-->
        <option value="BasicTestApp.CulturePicker">Culture Picker</option><!--!-->
        <option value="BasicTestApp.CustomElementsComponent">Custom elements</option><!--!-->
        <option value="BasicTestApp.DataDashComponent">data-* attribute rendering</option><!--!-->
        <option value="BasicTestApp.DispatchingComponent">Dispatching to sync context</option><!--!-->
        <option value="BasicTestApp.DuplicateAttributesComponent">Duplicate attributes</option><!--!-->
        <option value="BasicTestApp.DynamicComponentRendering">DynamicComponent rendering</option><!--!-->
        <option value="BasicTestApp.ElementFocusComponent">Element focus component</option><!--!-->
        <option value="BasicTestApp.ElementRefComponent">Element ref component</option><!--!-->
        <option value="BasicTestApp.ErrorComponent">Error throwing</option><!--!-->
        <option value="BasicTestApp.ErrorBoundaryTest.ErrorBoundaryContainer">Error boundary cases</o
Raw output 
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.WaitAssertCore[TResult](IWebDriver driver, Func`1 assertion, TimeSpan timeout) in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 129
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.WaitAssertCore(IWebDriver driver, Action assertion, TimeSpan timeout) in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 83
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.Equal[T](IWebDriver driver, T expected, Func`1 actual) in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 27
   at Microsoft.AspNetCore.Components.E2ETest.Tests.FormsInputDateTest.InputDateInteractsWithEditContext_NonNullableDateTime() in /home/vsts/work/1/s/src/Components/test/E2ETest/Tests/FormsInputDateTest.cs:line 51
   at InvokeStub_FormsInputDateTest.InputDateInteractsWithEditContext_NonNullableDateTime(Object, Object, IntPtr*)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
----- Inner Stack Trace -----
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.<>c__DisplayClass17_0.<WaitAssertCore>b__0() in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 83
   at Microsoft.AspNetCore.E2ETesting.WaitAssert.<>c__DisplayClass18_0`1.<WaitAssertCore>b__0(IWebDriver _) in /home/vsts/work/1/s/src/Shared/E2ETesting/WaitAssert.cs:line 101
View more details on Azure Pipelines