Gate Result: ✅ PASSED

Platform: ANDROID · Base: main · Merge base: 1463c4c5

  Determining projects to restore...
  Restored /home/vsts/work/1/s/src/Graphics/src/Graphics/Graphics.csproj (in 1.32 sec).
  Restored /home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj (in 4 sec).
  Restored /home/vsts/work/1/s/src/Essentials/src/Essentials.csproj (in 3.9 sec).
  ##vso[build.updatebuildnumber]10.0.70-ci+azdo.14031550
  Graphics -> /home/vsts/work/1/s/artifacts/bin/Graphics/Debug/net10.0/Microsoft.Maui.Graphics.dll
  ##vso[build.updatebuildnumber]10.0.70-ci+azdo.14031550
  Essentials -> /home/vsts/work/1/s/artifacts/bin/Essentials/Debug/net10.0/Microsoft.Maui.Essentials.dll
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(285,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(295,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(302,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(312,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(319,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(326,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(338,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(348,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(360,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]
/home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(371,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentials/test/UnitTests/Essentials.UnitTests.csproj]

  Determining projects to restore...
  All projects are up-to-date for restore.
  ##vso[build.updatebuildnumber]10.0.70-ci+azdo.14031550
  Graphics -> /home/vsts/work/1/s/artifacts/bin/Graphics/Debug/net10.0/Microsoft.Maui.Graphics.dll
  ##vso[build.updatebuildnumber]10.0.70-ci+azdo.14031550
  Essentials -> /home/vsts/work/1/s/artifacts/bin/Essentials/Debug/net10.0/Microsoft.Maui.Essentials.dll
  Essentials.UnitTests -> /home/vsts/work/1/s/artifacts/bin/Essentials.UnitTests/Debug/net10.0/Microsoft.Maui.Essentials.UnitTests.dll
Test run for /home/vsts/work/1/s/artifacts/bin/Essentials.UnitTests/Debug/net10.0/Microsoft.Maui.Essentials.UnitTests.dll (.NETCoreApp,Version=v10.0)
VSTest version 18.0.1 (x64)

Starting test execution, please wait...
A total of 1 test files matched the specified pattern.
[xUnit.net 00:00:00.01] xUnit.net VSTest Adapter v2.8.2+699d445a1a (64-bit .NET 10.0.0)
[xUnit.net 00:00:00.14]   Discovering: Microsoft.Maui.Essentials.UnitTests
[xUnit.net 00:00:00.60]   Discovered:  Microsoft.Maui.Essentials.UnitTests
[xUnit.net 00:00:00.62]   Starting:    Microsoft.Maui.Essentials.UnitTests
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: null, expected: "") [11 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://0.0.0.1/index.html#code=1234asdf", expected: "https://0.0.0.1/index.html") [4 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com/path#frag?notquery", expected: "https://example.com/path") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com/path?query=1#frag", expected: "https://example.com/path") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com?foo=bar", expected: "https://example.com") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com/index.html#code=abc", expected: "https://example.com/index.html") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com", expected: "https://example.com") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "https://example.com/path?query=1&other=2", expected: "https://example.com/path") [< 1 ms]
  Passed Tests.WebUtils_Tests.RemovePossibleQueryString_ReturnsExpected(input: "", expected: "") [< 1 ms]
[xUnit.net 00:00:00.84]   Finished:    Microsoft.Maui.Essentials.UnitTests
  Passed Tests.WebUtils_Tests.ResolveRelativePath_ValidRelative_ReturnsPath [< 1 ms]
  Passed Tests.WebUtils_Tests.ResolveRelativePath_EncodedDotDot_HandledCorrectly [11 ms]
  Passed Tests.WebUtils_Tests.ResolveRelativePath_RootRequest_ReturnsEmpty [< 1 ms]
  Passed Tests.WebUtils_Tests.ResolveRelativePath_DifferentOrigin_ReturnsNull [< 1 ms]
  Passed Tests.WebUtils_Tests.ResolveRelativePath_DoubleSlash_MakeRelativeUri_ProducesRooted_ReturnsNull [< 1 ms]
  Passed Tests.WebUtils_Tests.ResolveRelativePath_SubPath_ReturnsPath [< 1 ms]

Test Run Successful.
Total tests: 15
     Passed: 15
 Total time: 2.1234 Seconds

⚠️ Failure Details

• 🛠️ WebUtils_Tests without fix: build failed before tests could run
  • /home/vsts/work/1/s/src/Essentials/test/UnitTests/FileSystemUtils_Tests.cs(285,33): error CS0117: 'FileSystemUtils' does not contain a definition for 'EnsureFileName' [/home/vsts/work/1/s/src/Essentia...

Detected UI test categories: Essentials

Issue: #31472 - HybridWebViewQueryStringHelper.RemovePossibleQueryString removes '?' but not other special characters e.g. '#'
PR: #31597 - Update HybridWebViewQueryStringHelper.cs
Platforms Affected: Android, iOS, Windows (all HybridWebView platforms)
Files Changed: 1 implementation (WebUtils.shared.cs), 1 test (WebUtils_Tests.cs)

Key Findings

• WebUtils.RemovePossibleQueryString was only stripping ? query strings, not # fragment identifiers
• OAuth/OIDC implicit flow redirects URLs like https://0.0.0.0/index.html#code=abc, causing HybridWebView to look up a file named index.html#code=abc which does not exist
• The fix extends the method to strip both ? and # using IndexOfAny with a static readonly char[] field
• All three HybridWebView callers (Android MauiHybridWebViewClient, iOS HybridWebViewHandler.iOS, Windows HybridWebViewHandler.Windows) are covered via the shared utility
• BlazorWebView QueryStringHelper.cs has the same bug but is mirrored from ASP.NET Core upstream — out of scope for this PR
• CLA signature pending from contributor; CI pipelines just triggered (May 6, 2026)

Code Review Summary

Verdict: LGTM
Confidence: high
Errors: 0 | Warnings: 0 | Suggestions: 0

Key code review findings:

• No errors, warnings, or actionable suggestions found. The existing @kubaflo review comment already captured all nits (method rename as follow-up, BlazorWebView parity as separate issue). All nits were addressed in this PR (static readonly field, 4 new unit tests).

Fix Candidates

Code Review — PR #31597

Independent Assessment

What this changes: WebUtils.RemovePossibleQueryString is extended to strip URL fragments (the #… portion) in addition to query strings (?…). A static readonly char[] field replaces the inline IndexOf('?') call, and IndexOfAny is used to find whichever delimiter appears first. Four new unit test cases cover the fragment-stripping scenarios.

Inferred motivation: A HybridWebView app using OAuth/OIDC (MSAL implicit flow) navigates to a redirect URL like https://0.0.0.0/index.html#code=abc. The WebView interceptor must strip the fragment before looking up the local file asset; without this fix it tries to open a file named index.html#code=abc… which does not exist, causing a 404 or blank page.

Reconciliation with PR Narrative

Author claims: "Change so both # and ? will be taken into consideration to remove to allow to load the appropriate local file." Links issue #31472.

Agreement: Complete. The code implements precisely the workaround the author self-identified in the issue, extended cleanly to all three HybridWebView platforms via the shared utility method.

Findings

All meaningful code-level observations were already captured by @kubaflo (MEMBER) in their May 6 comment:

• Method naming (RemovePossibleQueryString now strips fragments too) — noted, acknowledged as a follow-up rename.
• BlazorWebView QueryStringHelper.cs parity gap — noted, explicitly marked out of scope, suggested as a separate issue.
• static readonly char[] field — already done in this PR.
• Test coverage — already added in this PR.

No new inline findings surfaced beyond those.

Correctness Deep-Dive

All three HybridWebView callers are covered:

• MauiHybridWebViewClient.cs:71 (Android) ✓
• HybridWebViewHandler.iOS.cs:239 (iOS) ✓
• HybridWebViewHandler.Windows.cs:167 (Windows) ✓

All three call RemovePossibleQueryString → new Uri(result) → AppOriginUri.IsBaseOf(uri) → ResolveRelativePath. Stripping # before this chain is exactly correct.

IndexOfAny(char[]) semantics are correct: Inherently ordinal (char equality), which is the right behavior for ? and # ASCII delimiters.

Percent-encoded %23: IndexOfAny searches the raw string, so a literal %23 in a path component is not mistakenly stripped. Correct.

Test case "https://example.com/path#frag?notquery" → "https://example.com/path": Validates that IndexOfAny returns the first occurrence (position of #), not the position of ?. This is the key correctness invariant.

CI Status

Status: ⚠️ Incomplete (pipeline running)

• license/cla — queued (not yet completed); CLA signature pending from contributor
• Build Analysis — in progress
• Device/UI test pipelines triggered May 6, 2026 — results not yet visible

CI is not red due to the PR's code changes.

Devil's Advocate

"Could stripping # cause a regression for apps that DON'T use fragments?"
IndexOfAny returns -1 if neither ? nor # is found, so the code path for plain https://0.0.0.0/index.html is unchanged. ✓

"What if a Blazor app hits the same OAuth fragment scenario?"
QueryStringHelper.cs (BlazorWebView) still only strips ?. That is a pre-existing gap not introduced by this PR. Not a regression. ✓

"Is there any concern about Substring performance?"
This method is called inside a WebView URL-interception callback (cold path). Allocation is irrelevant here. ✓

Verdict: LGTM

Confidence: high

Summary: The fix is minimal, correct, and well-tested. It addresses a real user-visible bug (OAuth fragment redirects breaking HybridWebView) by extending the existing RemovePossibleQueryString utility to also strip #-fragments. All three HybridWebView platform handlers are covered via the shared method. The two nits worth tracking (method rename, BlazorWebView parity) are already documented in existing review comments and appropriate as follow-up items.

Fix Candidates

Cross-Pollination

Exhausted: Yes — no materially new approaches remain
Selected Fix: PR's fix — minimal, explicit, readable, already has tests and Gate passed

Comparison Notes

• try-fix-2 (url.AsSpan().IndexOfAny('?','#')) is arguably marginally simpler (1 line vs 3 lines in PR) but the PR's approach with static readonly char[] is more explicit about intent and matches codebase patterns
• All three passing candidates (PR, tf-1, tf-2, tf-4) produce identical outputs for all test cases
• The PR fix is the best candidate: already reviewed, tested, comes with 4 new unit tests, and follows a clear intent-revealing pattern

✅ Final Recommendation: APPROVE

Phase Status

Code Review Impact on Try-Fix

Code review returned LGTM with zero findings, so no ❌ Error hints were provided to try-fix models. The hints field described the code-review verdict and directed each model to explore a different alternative strategy. Models chose: URI framework parsing (tf-1), allocation-free span scan (tf-2), URI path extraction (tf-3, blocked by env), and compiled Regex (tf-4). All passing candidates produced functionally identical outputs.

Summary

PR #31597 fixes a real user-visible bug in WebUtils.RemovePossibleQueryString — the method previously stripped only ? query strings, not # fragments. This caused HybridWebView to attempt loading non-existent files (e.g. index.html#code=abc) when OAuth/OIDC redirects included fragment identifiers. The fix is minimal (1 implementation file, 1 test file), correct, and well-tested. All three HybridWebView platform callers (Android, iOS, Windows) are covered via the shared utility.

Root Cause

HybridWebView's request interceptor calls WebUtils.RemovePossibleQueryString to get a clean file path from the intercepted URL. The method used IndexOf('?') only, missing the URL fragment delimiter #. RFC 3986 defines # as starting the fragment, which must be stripped before looking up a local asset. The fix uses IndexOfAny(new[]{'?','#'}) with a static readonly field, correctly stripping whichever delimiter appears first.

Fix Quality

Winner: pr (the PR's original fix)

The PR's fix is clean, minimal, and follows established codebase patterns. Four independent try-fix explorations found no superior alternative:

The PR's pattern (static readonly char[] + IndexOfAny) is explicit about which delimiters are handled, self-documenting through the field name s_queryOrFragmentDelimiters, and consistent with the codebase's existing pattern in ParseQueryString. The span approach (tf-2) would be a valid micro-optimization but the overhead is irrelevant for a cold URL interception path.

Non-code blockers to merge:

1. CLA signature pending from @Walkramis (bot request posted May 6, 2026)
2. CI pipelines triggered May 6, 2026 — final results pending