A .net framework bug

by Matt 19. December 2006 17:56

Yep. I've found an honest-to-goodness bug in the framework. And it's genuine, too. Not one of your "my code's not working, .net's broken" bugs. Nope. I've got proof.

Uri.IsHexEncoding checks for the pattern %hexhex is at a particular offset in a string. So you can write something like this to check if a string is uri encoded:

public bool IsUriEncoded(string uri)
{
	for(int i=0;i<uri.Length;i++)
	{
		if(Uri.IsHexEncoding(uri,i))
			return true;
	}
	return false;
}

For a string such as "/path/%2f/hello", it will return true. For a string such as "/path/%xx/hello", it will return false.

Fancy finding a bug? Get your mince pies round this - it's the source for Uri.IsHexEncoding (this snippet brought to you by the letter "Reflector"):

public static bool IsHexEncoding(string pattern, int index)
{
	if(((pattern.Length - index) >= 3)
		&& ((pattern[index] == '%') 
		&& (Uri.EscapedAscii(pattern[index + 1],
			pattern[index + 1]) != 0xffff)))
	{
		return true;
	}
	return false;
}

Spotted it yet? Try the string "%2y". It returns true.

The second parameter to Uri.EscapedAscii should be "pattern[index + 2]", not "pattern[index + 1]".

My feeling is that this method would be mostly used in a security checking context, so it's really important it works correctly.

So, a proper bug. I've reported it as a bug on Microsoft Connect (log in required). I've even added a comment to the msdn docs page (which is a really rather cool feature). I couldn't be more helpful even if I went round everyone's computers and fixed their code for them.

PS. It's dead easy to work around. You'll probably call it in a loop like the one above. Just change the line calling Uri.IsHexEncoding to:

if(uri[i]=='%' && Uri.IsHexDigit[i+1] && Uri.IsHexDigit[i+2)
	return true;

Tags:

asp.net

Comments (23) -

Dyan Ragain
Dyan Ragain
4/21/2011 6:51:22 PM #

I like your current content incredibly informative, continue to keep posting

Reply

Joey Brown
Joey Brown
6/6/2011 6:28:24 PM #

This is a great read, keep up the great work!

Reply

Anthony Mark
Anthony Mark
6/16/2011 10:01:11 PM #

Top info deserve a big thanks.love it! <a href= ” http://www.getpromoted.in”>  Web Designer Gurgaon</a>

Reply

LAURENCE  Debora
LAURENCE Debora
7/2/2011 6:16:37 PM #

Créer un annuaire rémunérateur de qualité en quelques clics sur annuaires-gratuit.com

Reply

LAURENCE  Debora
LAURENCE Debora
7/16/2011 6:12:49 PM #

Création annuaire - annuaire Création annuaire sur annuaires-gratuit.com, vos avis svp.

Reply

best suv 2010
best suv 2010
7/20/2011 10:20:16 PM #

Hi,what an excellent article this is,I found it on bing and I like it very much,I agree with what you have said, lots of things will be learned form your site,but I still have some questions with the last part,can you explain it for me ?I will appreciate your answer,and I will be back again!

Reply

LAURENCE  Debora
LAURENCE Debora
7/22/2011 11:22:30 PM #

Service de recherche en ligne sur Sukoga.com, recherche ebay, sports, images, wiki.

Reply

LAURENCE  Debora
LAURENCE Debora
7/27/2011 10:48:14 AM #

Bienvenue sur annuaires-gratuit.com.Des fonctionnalités inédites, nombreuses annuaires.

Reply

DEBORA Laurence
DEBORA Laurence
8/1/2011 8:35:16 AM #

Il ne vous reste plus qu' à créer votre propre annuaire, l'inscription est  gratuite .

Reply

photographe mariage paris
photographe mariage paris United States
6/8/2015 2:26:20 AM #

Thanks for this glorious article. One other thing is that almost all digital cameras can come equipped with some sort of zoom lens so that more or less of a scene for being included by 'zooming' in and out. These kind of changes in focus length are usually reflected from the viewfinder and on big display screen at the back of the specific camera.

Reply

Philix
Philix United States
11/21/2015 9:25:43 AM #

superb website

Reply

Natividad Sluder
Natividad Sluder United States
1/6/2016 3:53:27 PM #

Well good for you! I have a lot but one I just thought of was when you lick a crease of paper so that it'll rip in a straight line and it actually tears in a frayed straight line rather than rips awkwardly. I love that bleachy taste and that bleachy satisfaction.

Reply

Jared Teteak
Jared Teteak United States
1/15/2016 4:57:03 AM #

Hey, congratulations Neil. This site really is something special and it's been a pleasure to share it with my readership too. Looking forward to future awesome things, and I'll send any suggestions that are sufficiently awesome.

Reply

Antony Goren
Antony Goren United States
1/15/2016 6:24:10 AM #

The dolphin saving you one is the best one!

Reply

Sharri Michonski
Sharri Michonski United States
1/15/2016 6:44:16 AM #

I can't wait to read this masterpiece. Ordering off the menu at fast food restaurants and old dangerous playground equipment have to be in the book!

Reply

Palmer Rinck
Palmer Rinck United States
1/15/2016 7:19:22 AM #

Printing out an essay or paper, reading the first line and realizing there aren't any mistakes.<br />AWESOME!

Reply

Harriet Tenpas
Harriet Tenpas United States
1/15/2016 8:29:42 AM #

The dolphin saving you one is the best one!

Reply

Darnell Drape
Darnell Drape United States
1/15/2016 8:59:31 AM #

AWESOME!Can't wait for that, will be something to want to accomplish day by day, to do something AWESOME!

Reply

cairns solar
cairns solar United States
2/4/2016 6:45:48 PM #

Use common sense, if it's something you have to question..then don't do it.

Reply

Randy Nault
Randy Nault United States
7/20/2016 7:43:32 AM #

You have an accurate point of view, thanks!

Reply

Scott Kevin
Scott Kevin United States
8/5/2016 6:31:08 PM #

Представляем новый веб- сайт знакомств будет оштрафован на широкий свою настоящую любовь в http://youllfindlove.com/

Reply

Steffanie Cocroft
Steffanie Cocroft United States
8/25/2016 4:07:01 AM #

In today's technological advances, I sure hope to read another informative post like this about the smart house architectural designs

Reply

Verdie Seymour
Verdie Seymour United States
12/28/2016 9:33:24 PM #

I will create a Professional Whiteboard Animation Video.Create a professional WHITEBOARD ANIMATION VIDEO and engage your audience!! Fiverr TOP RATED SELLER with over 9000 positive reviews with 3000+ happy customers!

Reply

Add comment

biuquote
  • Comment
  • Preview
Loading

Rel=Me

Month List

RecentComments

Comment RSS