Skip to content

Remove Uri scheme validation from HttpRequestMessage - #55035

Merged
MihaZupan merged 7 commits into
dotnet:mainfrom
MihaZupan:defer-scheme-check
Jul 10, 2021
Merged

Remove Uri scheme validation from HttpRequestMessage#55035
MihaZupan merged 7 commits into
dotnet:mainfrom
MihaZupan:defer-scheme-check

Conversation

@MihaZupan

@MihaZupanMihaZupan commented Jul 1, 2021•
edited
Loading

Copy link
Copy Markdown
Member

Fixes#52836

Removed the Uri scheme check from HttpRequestMessage / HttpClient.BaseAddress and moved it in SocketsHttpHandler.ValidateAndNormalizeRequest.

Any scheme will be passed to handlers.

No merge: Should other handlers have filters for specific schemes?
WinHttpHandler takes 85 seconds to figure out it can't process foo://httpbin.org without a fail-fast like this for example.
Added http / https checks to WinHttpHandler.

@MihaZupanMihaZupan added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Jul 1, 2021
@MihaZupanMihaZupan added this to the 6.0.0 milestone Jul 1, 2021
@MihaZupan
MihaZupan requested a review from a teamJuly 1, 2021 19:50
@MihaZupanMihaZupan self-assigned this Jul 1, 2021
@ghostghost added the area-System.Net label Jul 1, 2021
@ghost

ghost commented Jul 1, 2021

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

Fixes #52836

Removed the Uri scheme check from HttpRequestMessage / HttpClient.BaseAddress and moved it in SocketsHttpHandler.ValidateAndNormalizeRequest.

Any scheme will be passed to handlers.

No merge: Should other handlers have filters for specific schemes?
WinHttpHandler takes 85 seconds to figure out it can't process foo://httpbin.org without a fail-fast like this for example.

Author:MihaZupan
Assignees:MihaZupan
Labels:

* NO MERGE *, area-System.Net

Milestone:6.0.0

geoffkizer
geoffkizer reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/HttpRequestMessage.cs Outdated
geoffkizer
geoffkizer reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/HttpUtilities.cs Outdated
geoffkizer
geoffkizer reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/tests/UnitTests/System.Net.Http.Unit.Tests.csproj Outdated
@geoffkizer

geoffkizer commented Jul 1, 2021

Copy link
Copy Markdown
Contributor

No merge: Should other handlers have filters for specific schemes?
WinHttpHandler takes 85 seconds to figure out it can't process foo://httpbin.org without a fail-fast like this for example.

Yeah, we should add the same logic to WinHttpHandler.

stephentoub
stephentoub reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/HttpClient.cs Outdated
stephentoub
stephentoub reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs Outdated
stephentoub
stephentoub reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs Outdated
stephentoub
stephentoub reviewed Jul 1, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs Outdated
@MihaZupanMihaZupan removed the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label Jul 2, 2021
@MihaZupan

MihaZupan commented Jul 8, 2021

Copy link
Copy Markdown
MemberAuthor

With this PR:

  • HttpRequestMessage does not throw on any Uri
  • SocketsHttpHandler behavior remains the same (http, https, ws, wss)
  • WinHttpHandler only accepts http and https
  • BrowserHttpHandler will receive any Url (any absolute scheme + any relative)

@lewing is this the desired behavior for Browser, or should we be filtering out relative Uris?

@MihaZupan

MihaZupan commented Jul 9, 2021

Copy link
Copy Markdown
MemberAuthor

/azp run runtime-libraries-coreclr outerloop

@azure-pipelines

azure-pipelinesBot commented Jul 9, 2021

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

stephentoub
stephentoub reviewed Jul 9, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http.WinHttpHandler/src/Resources/Strings.resx Outdated
stephentoub
stephentoub reviewed Jul 9, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http.WinHttpHandler/tests/FunctionalTests/WinHttpHandlerTest.cs Outdated
stephentoub
stephentoub reviewed Jul 9, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/HttpMessageInvoker.cs Outdated

@stephentoubstephentoubJul 9, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we disable telemetry if the Uri isn't absolute?

@MihaZupanMihaZupanJul 9, 2021

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The call to RequestStart that follows this check will access Uri fields that would throw for relative Uris.

Adding this check here so that you get the meaningful exception message from SocketsHttpHandler instead.

stephentoub
stephentoub reviewed Jul 9, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/MessageProcessingHandler.cs Outdated
stephentoub
stephentoub reviewed Jul 9, 2021
View reviewed changes
Comment threadsrc/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpUtilities.cs Outdated

@stephentoubstephentoubJul 9, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good riddance. Thanks!

@MihaZupan
MihaZupanforce-pushed the defer-scheme-check branch from 9eb1416 to da8844dCompareJuly 9, 2021 15:33
@MihaZupan
MihaZupan merged commit 9da4d07 into dotnet:mainJul 10, 2021
@karelzkarelz mentioned this pull request Jul 20, 2021
Closed
@ManickaPManickaP mentioned this pull request Jul 20, 2021
Merged
@ghostghost locked as resolved and limited conversation to collaborators Aug 9, 2021
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@stephentoubstephentoubstephentoub approved these changes
+2 more reviewers
@campersaucampersaucampersau left review comments
@geoffkizergeoffkizergeoffkizer left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@MihaZupanMihaZupan

Labels

area-System.Net

Projects

None yet

Milestone

6.0.0

Development

Successfully merging this pull request may close these issues.

Support to request extensions://** by HttpClient

4 participants

@MihaZupan@geoffkizer@stephentoub@campersau