diff --git a/identity-server/src/IdentityServer/Extensions/StringsExtensions.cs b/identity-server/src/IdentityServer/Extensions/StringsExtensions.cs index a92d2ff1b..c86503186 100644 --- a/identity-server/src/IdentityServer/Extensions/StringsExtensions.cs +++ b/identity-server/src/IdentityServer/Extensions/StringsExtensions.cs @@ -207,12 +207,9 @@ public static bool IsUri(this string input) return false; } - if (uri.IsFile && !input.StartsWith(Uri.UriSchemeFile + "://", StringComparison.OrdinalIgnoreCase)) - { - return false; - } - - return true; + return !uri.IsFile || + // no need to check if input starts with {Uri.UriSchemeFile}:// because uri.IsFile ensures it is either '/' or `file://` + input.StartsWith(Uri.UriSchemeFile, StringComparison.OrdinalIgnoreCase); } [DebuggerStepThrough] diff --git a/identity-server/test/IdentityServer.UnitTests/Extensions/StringExtensionsTests.cs b/identity-server/test/IdentityServer.UnitTests/Extensions/StringExtensionsTests.cs index 364ca6615..2585626b5 100644 --- a/identity-server/test/IdentityServer.UnitTests/Extensions/StringExtensionsTests.cs +++ b/identity-server/test/IdentityServer.UnitTests/Extensions/StringExtensionsTests.cs @@ -176,7 +176,9 @@ public void IsUri_should_block_paths() { // especially on linux // https://github.com/DuendeSoftware/Support/issues/148 + " /path".IsUri().Should().BeFalse(); "/path".IsUri().Should().BeFalse(); + " //".IsUri().Should().BeFalse(); "//".IsUri().Should().BeFalse(); "://".IsUri().Should().BeFalse(); " ://".IsUri().Should().BeFalse();