Skip to content

Fix Uri.TryUnescapeDataString throwing instead of returning false with small destination buffers #124655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MihaZupan merged 3 commits into from
Feb 24, 2026
Merged

Fix Uri.TryUnescapeDataString throwing instead of returning false with small destination buffers #124655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
72c2429
Initial plan
Copilot Feb 20, 2026
0da8f6a
Fix Uri.TryUnescapeDataString to return false instead of throwing wit…
Copilot Feb 20, 2026
fd94829
Move destination length check before overlapped check
Copilot Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/libraries/System.Private.Uri/src/System/UriExt.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -548,6 +548,12 @@ public static bool TryUnescapeDataString(ReadOnlySpan<char> charsToUnescape, Spa
return false;
}

if (destination.Length < indexOfFirstToUnescape)
{
charsWritten = 0;
return false;
}

// We may throw for very large inputs (when growing the ValueStringBuilder).
scoped ValueStringBuilder vsb;

Expand Down
12 changes: 12 additions & 0 deletions src/libraries/System.Private.Uri/tests/FunctionalTests/UriEscapingTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,6 +300,18 @@ static void ValidateUnescape(string input, string expectedOutput)
}
}

[Theory]
[InlineData("aa%", 0)]
[InlineData("aa%", 1)]
[InlineData("aaa%41", 0)]
[InlineData("aaa%41", 1)]
[InlineData("aaa%41", 2)]
public void TryUnescapeDataString_SmallDestination_ReturnsFalse(string input, int destinationLength)
{
Assert.False(Uri.TryUnescapeDataString(input, new char[destinationLength], out int charsWritten));
Assert.Equal(0, charsWritten);
}

[Fact]
public void UriEscapeUnescapeDataString_LongInputs()
{
Expand Down
Loading