huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add host caution to MVC GetUri extension methods (#12629)

This commit is contained in:
James Newton-King 2019-07-27 15:39:25 +12:00 committed by GitHub
parent 98abd9e256
commit 2d4fd05adf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Mvc/Mvc.Core/src/Routing/ControllerLinkGeneratorExtensions.cs
View File

@ -138,6 +138,14 @@ namespace Microsoft.AspNetCore.Routing
/// names from <c>RouteOptions</c>.
/// </param>
/// <returns>A absolute URI, or <c>null</c> if a URI cannot be created.</returns>
/// <remarks>
/// <para>
/// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
/// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
/// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
/// your deployment environment.
/// </para>
/// </remarks>
public static string GetUriByAction(
this LinkGenerator generator,
HttpContext httpContext,
@ -189,6 +197,14 @@ namespace Microsoft.AspNetCore.Routing
/// names from <c>RouteOptions</c>.
/// </param>
/// <returns>A absolute URI, or <c>null</c> if a URI cannot be created.</returns>
/// <remarks>
/// <para>
/// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
/// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
/// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
/// your deployment environment.
/// </para>
/// </remarks>
public static string GetUriByAction(
this LinkGenerator generator,
string action,

16
src/Mvc/Mvc.Core/src/Routing/PageLinkGeneratorExtensions.cs
View File

@ -135,6 +135,14 @@ namespace Microsoft.AspNetCore.Routing
/// names from <c>RouteOptions</c>.
/// </param>
/// <returns>A absolute URI, or <c>null</c> if a URI cannot be created.</returns>
/// <remarks>
/// <para>
/// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
/// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
/// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
/// your deployment environment.
/// </para>
/// </remarks>
public static string GetUriByPage(
this LinkGenerator generator,
HttpContext httpContext,
@ -186,6 +194,14 @@ namespace Microsoft.AspNetCore.Routing
/// names from <c>RouteOptions</c>.
/// </param>
/// <returns>A absolute URI, or <c>null</c> if a URI cannot be created.</returns>
/// <remarks>
/// <para>
/// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
/// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
/// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
/// your deployment environment.
/// </para>
/// </remarks>
public static string GetUriByPage(
this LinkGenerator generator,
string page,