[研究]Mend(WhiteSource) 建議使用不認得的 IsLocalUrl

[研究]Mend(WhiteSource) 建議使用不認得的 IsLocalUrl

2025-05-13

環境：Visual Studio 2022 + ASP.NET + WebForm + Web Application + C# + SQL Server 2019 + SQL Server Management Studio (SSMS) 20.2

********************************************************************************

下圖， Mend 建議

修改

string redirect = System.IO.Path.GetFileName(Request.PhysicalPath) + "?Seq=12&no=13&" + Url; //Mend建議新增(Begin) if (!Url.IsLocalUrl(redirect)) { Response.Redirect("../Error.aspx"); return; } //Mend建議新增(End)

下圖，Visual Studio 不認得 IsLocalUrl

**********

找到一份 CODE，考慮挪過來用，待測

https://github.com/aspnet/Mvc/blob/74c0d0c28744743610b4b856c632f191ff49dc33/src/Microsoft.AspNetCore.Mvc.Core/Routing/UrlHelper.cs#L105C13-L146C26

public virtual bool IsLocalUrl(string url) { if (string.IsNullOrEmpty(url)) { return false; } // Allows "/" or "/foo" but not "//" or "/\". if (url[0] == '/') { // url is exactly "/" if (url.Length == 1) { return true; } // url doesn't start with "//" or "/\" if (url[1] != '/' && url[1] != '\\') { return true; } return false; } // Allows "~/" or "~/foo" but not "~//" or "~/\". if (url[0] == '~' && url.Length > 1 && url[1] == '/') { // url is exactly "~/" if (url.Length == 2) { return true; } // url doesn't start with "~//" or "~/\" if (url[2] != '/' && url[2] != '\\') { return true; } return false; } return false; }

(完)

相關