Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Creating an Uri in .NET automatically urldecodes all parameters from passed string

Suppose I want to create an Uri object from the following string:

string url = @"http://someserver.com?param1=1&url=http%3a%2f%2fwww.otherserver.com";
Uri uri = new Uri(url, UriKind.Absolute);

Expected result would be:

http://someserver.com?param1=1&url=http%3a%2f%2fwww.otherserver.com 

Obtained:

http://someserver.com/?param1=1&url=http://www.otherserver.com

The same behavior is noticed in many related methods that allow Uri creation: Uri.TryCreate, UriBuilder.Uri, etc.

How would I get an Uri that preserve initial encoded parameter?

like image 595
Eugeniu Torica Avatar asked Sep 05 '11 12:09

Eugeniu Torica


People also ask

Why use Uri instead of string?

A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The Uri class provides these services in a safe and secure manner.

What is a URI in C#?

A URI is a compact representation of a resource available to your application on the intranet or internet. The Uri class defines the properties and methods for handling URIs, including parsing, comparing, and combining. The Uri class properties are read-only; to create a modifiable object, use the UriBuilder class.


3 Answers

In .NET4 you can disable Uri compaction for certain scheme via a configuration:

<configuration>
  <uri>
    <schemeSettings>
      <add name="http" genericUriParserOptions="DontUnescapePathDotsAndSlashes"/>
    </schemeSettings>
  </uri>
</configuration>

Note that there are security implications related to disabling of the default behaviour.

like image 136
Pencho Ilchev Avatar answered Oct 25 '22 09:10

Pencho Ilchev


How did you "obtain" the URL? If I hover my mouse over it in Visual Studio, it indeed shows the decoded URL.

But whenever I access it through the AbsoluteUri property, it shows the encoded URL.

like image 26
CodeCaster Avatar answered Oct 25 '22 11:10

CodeCaster


This behavior is documented:

As part of canonicalization in the constructor for some schemes, escaped representations are compacted. The schemes for which URI will compact escaped sequences include the following: file, http, https, net.pipe, and net.tcp. For all other schemes, escaped sequences are not compacted. For example: if you percent encode the two dots ".." as "%2E%2E" then the URI constructor will compact this sequence for some schemes. For example, the following code sample shows a URI constructor for the http scheme.

So one workaround might be temporarily using a custom scheme (e.g. leavemealone://) to construct the URL objects (possibly through UriBuilder?).

like image 3
Jon Avatar answered Oct 25 '22 10:10

Jon