Add URL scheme validation for HTTP redirects in SocketsHttpHandler by Copilot · Pull Request #121263 · dotnet/runtime

Copilot · 2025-11-01T06:17:41Z

Add URL Scheme Validation on Redirects

This PR adds missing URL scheme validation when following HTTP redirects in SocketsHttpHandler.

Problem:

SocketsHttpHandler validates URL schemes before sending the initial request
However, it does NOT validate schemes when following redirects
This could allow redirects to unsupported schemes like "ftp://" or "file://"

Solution:
Add the same IsSupportedScheme validation in RedirectHandler.GetUriForRedirect() after the existing https->http downgrade check. When a redirect to an unsupported scheme is detected:

SocketsHttpHandler: Returns the original 3xx response without following the redirect
WinHttpHandler: Throws HttpRequestException with inner WinHttpException (error 12156)

Changes:

RedirectHandler.cs: Added scheme validation check (11 lines)
HttpClientHandlerTest.AutoRedirect.cs: Added test verifying both handler behaviors (35 lines)

Testing:

✅ New test passes: 8 tests (2 handler implementations × 4 schemes)
✅ Existing redirect tests pass: 133 tests
✅ Code review: No issues found
✅ Security scan: No issues found

Checklist:

Understand the issue and explore codebase
Establish baseline build
Add scheme validation in RedirectHandler.GetUriForRedirect()
Add test case for redirect to unsupported scheme
Update test to handle WinHttpHandler exception behavior
Build and test the changes
Run code review
Run security scan
Final verification

Original prompt

This section details on the original issue you should resolve

<issue_title>SocketsHttpHandler is missing unknown request url scheme validation on redirects</issue_title>
<issue_description>We're validating that we're not following a redirect from https to http.

runtime/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs

Lines 133 to 134 in 5ebfca2

// Disallow automatic redirection from secure to non-secure schemes

if (HttpUtilities.IsSupportedSecureScheme(requestUri.Scheme) && !HttpUtilities.IsSupportedSecureScheme(location.Scheme))

We should also check that the new request url scheme is valid at all, as we do before sending the initial request

runtime/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/SocketsHttpHandler.cs

Lines 680 to 683 in 5ebfca2

if (!HttpUtilities.IsSupportedScheme(requestUri.Scheme))

{

return new NotSupportedException(SR.Format(SR.net_http_unsupported_requesturi_scheme, requestUri.Scheme));

}

</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes SocketsHttpHandler is missing unknown request url scheme validation on redirects #116857

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com>

dotnet-policy-service · 2025-11-01T16:19:06Z

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull Request Overview

This PR adds a security enhancement to block automatic HTTP redirects to unsupported URI schemes (ftp, file, gopher, telnet, etc.). The changes prevent potential security issues where a malicious server could redirect an HTTP/HTTPS request to a different protocol scheme.

Adds a check in RedirectHandler.GetUriForRedirect to validate the redirect location scheme
Returns the original redirect response (302, 307, etc.) instead of following unsafe redirects
Includes comprehensive test coverage for multiple unsupported schemes

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
RedirectHandler.cs	Adds unsupported scheme validation before processing redirects
HttpClientHandlerTest.AutoRedirect.cs	Adds test cases validating that redirects to ftp, file, gopher, and telnet schemes are blocked

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs

wfurt

LGTM

src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AutoRedirect.cs

…chemes Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com>

MihaZupan · 2025-11-03T18:23:22Z

/ba-g android timing out

Initial plan

8329152

Copilot AI assigned Copilot and MihaZupan Nov 1, 2025

Copilot started work on behalf of MihaZupan November 1, 2025 06:18 View session

Add URL scheme validation on redirects

7a4dbc3

Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add validation for request URL scheme on redirects~~ Add URL scheme validation for HTTP redirects in SocketsHttpHandler Nov 1, 2025

Copilot AI requested a review from MihaZupan November 1, 2025 07:02

Copilot finished work on behalf of MihaZupan November 1, 2025 07:02

build-analysis bot mentioned this pull request Nov 1, 2025

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

3 tasks

MihaZupan approved these changes Nov 1, 2025

View reviewed changes

MihaZupan added this to the 11.0.0 milestone Nov 1, 2025

MihaZupan added the area-System.Net.Http label Nov 1, 2025

MihaZupan marked this pull request as ready for review November 1, 2025 16:18

Copilot AI review requested due to automatic review settings November 1, 2025 16:18

Copilot AI reviewed Nov 1, 2025

View reviewed changes

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs Show resolved Hide resolved

MihaZupan requested a review from a team November 1, 2025 18:35

wfurt approved these changes Nov 2, 2025

View reviewed changes

stephentoub approved these changes Nov 2, 2025

View reviewed changes

src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.AutoRedirect.cs Outdated Show resolved Hide resolved

Copilot started work on behalf of MihaZupan November 3, 2025 08:42 View session

Update test to verify WinHttpHandler throws on unsupported redirect s…

29aacc1

…chemes Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com>

Copilot finished work on behalf of MihaZupan November 3, 2025 09:05

Copilot AI requested a review from MihaZupan November 3, 2025 09:05

This was referenced Nov 3, 2025

Checkout failure: "Git fetch failed with exit code 128" dotnet/arcade#9009

Open

Failed to install runtime_python_requirements #114924

Open

MihaZupan approved these changes Nov 3, 2025

View reviewed changes

build-analysis bot mentioned this pull request Nov 3, 2025

Unable to pull image from mcr.microsoft.com #117164

Open

MihaZupan merged commit 16940c3 into main Nov 3, 2025
82 of 87 checks passed

dotnet-maestro bot mentioned this pull request Nov 6, 2025

[main] Source code updates from dotnet/runtime dotnet/dotnet#3258

Merged

jkotas deleted the copilot/validate-url-scheme-on-redirects branch November 12, 2025 05:17

github-actions bot locked and limited conversation to collaborators Dec 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add URL scheme validation for HTTP redirects in SocketsHttpHandler#121263

Add URL scheme validation for HTTP redirects in SocketsHttpHandler#121263
MihaZupan merged 3 commits intomainfrom
copilot/validate-url-scheme-on-redirects

Copilot AI commented Nov 1, 2025 •

edited

Loading

Uh oh!

dotnet-policy-service bot commented Nov 1, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

wfurt left a comment

Uh oh!

Uh oh!

MihaZupan commented Nov 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	// Disallow automatic redirection from secure to non-secure schemes
	if (HttpUtilities.IsSupportedSecureScheme(requestUri.Scheme) && !HttpUtilities.IsSupportedSecureScheme(location.Scheme))

	if (!HttpUtilities.IsSupportedScheme(requestUri.Scheme))
	{
	return new NotSupportedException(SR.Format(SR.net_http_unsupported_requesturi_scheme, requestUri.Scheme));
	}

Conversation

Copilot AI commented Nov 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add URL Scheme Validation on Redirects

Comments on the Issue (you are @copilot in this section)

Uh oh!

dotnet-policy-service bot commented Nov 1, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

wfurt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MihaZupan commented Nov 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Nov 1, 2025 •

edited

Loading