Skip to content

.NET: sanitize redirectUrl for logs #2356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DeagleGross merged 3 commits into from
Nov 21, 2025
Merged

.NET: sanitize redirectUrl for logs #2356

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc7b4be
sanitize redirectUrl for logs
DeagleGross Nov 20, 2025
4145dd6
use basepath
DeagleGross Nov 20, 2025
1da8bd4
sanitize both path and reddirect url
DeagleGross Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions dotnet/src/Microsoft.Agents.AI.DevUI/DevUIMiddleware.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
using System.IO.Compression;
using System.Reflection;
using System.Security.Cryptography;
using System.Text.RegularExpressions;
using Microsoft.AspNetCore.StaticFiles;
using Microsoft.Extensions.Primitives;
using Microsoft.Net.Http.Headers;
Expand All @@ -13,8 +14,11 @@ namespace Microsoft.Agents.AI.DevUI;
/// <summary>
/// Handler that serves embedded DevUI resource files from the 'resources' directory.
/// </summary>
internal sealed class DevUIMiddleware
internal sealed partial class DevUIMiddleware
{
[GeneratedRegex(@"[\r\n]+")]
private static partial Regex NewlineRegex();

private const string GZipEncodingValue = "gzip";
private static readonly StringValues s_gzipEncodingHeader = new(GZipEncodingValue);
private static readonly Assembly s_assembly = typeof(DevUIMiddleware).Assembly;
Expand Down Expand Up @@ -70,15 +74,16 @@ public async Task HandleRequestAsync(HttpContext context)
// This ensures relative URLs in the HTML work correctly
if (string.Equals(path, this._basePath, StringComparison.OrdinalIgnoreCase) && !path.EndsWith('/'))
{
var redirectUrl = $"{path}/";
var redirectUrl = this._basePath + "/";
if (context.Request.QueryString.HasValue)
{
redirectUrl += context.Request.QueryString.Value;
}

context.Response.StatusCode = StatusCodes.Status301MovedPermanently;
context.Response.Headers.Location = redirectUrl;
this._logger.LogDebug("Redirecting {OriginalPath} to {RedirectUrl}", path, redirectUrl);

this._logger.LogDebug("Redirecting {OriginalPath} to {RedirectUrl}", NewlineRegex().Replace(path, ""), NewlineRegex().Replace(redirectUrl, ""));
return;
}

Expand Down
Loading