Aspnetcore: Blazor throws when location contains `%20`

[newbienewbie]

Describe the bug

(Not sure whether it is a bug.)

When window.location.href contains percentage encoded characters(Non-ASCII) , and if there's a space which is encoding to %20 at the same time, the Blazor Hub's method StartCircuit() throws.

To Reproduce

1. dotnet new blazorserver
2. dotnet run
3. Browse https://localhost:5001?keyword=你好 世界 with Chrome, press F12 and there's an Error: The uris provided are invalid. in the console.

See also this thread on SO

Addtional Research

1. When pasting https://localhost:5001?keyword=你好 世界 into Chrome, this url is encoded to
   https://localhost:5001/?keyword=%E4%BD%A0%E5%A5%BD%20%E4%B8%96%E7%95%8C
   Since the location is percentage encoded, this should be valid URL.
2. But the signalR method StartCircuit() treats the uri as an invalid URL: https://github.com/aspnet/AspNetCore/blob/4a7bf75e89e3dfe7264a641ed041f50788d28d20/src/Components/Server/src/ComponentHub.cs#L93
   Test:
   var uri = “ https://localhost:5001/?keyword=%E4%BD%A0%E5%A5%BD%20%E4%B8%96%E7%95%8C”; var result = System.Uri.IsWellFormedUriString(uri, System.UriKind.Absolute)? true: false;
3. Currently walkaround: add a <script> to replace the %20 to + before the signalR method invoked.
4. See also this thread on SO : https://stackoverflow.com/questions/1634271/url-encoding-the-space-character-or-20
5. Might be a related issue : https://github.com/aspnet/AspNetCore/issues/14366#issue-497579154

Further technical details

• ASP.NET Core version

dotnet --version
3.0.100

• Include the output of dotnet --info

dotnet --info
.NET Core SDK (reflecting any global.json):
 Version:   3.0.100   
 Commit:    04339c3a26

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.18362
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\3.0.100\

Host (useful for support):
  Version: 3.0.0
  Commit:  7d57652f33

.NET Core SDKs installed:
  1.1.12 [C:\Program Files\dotnet\sdk]
  1.1.13 [C:\Program Files\dotnet\sdk]
  2.0.0 [C:\Program Files\dotnet\sdk]
  2.1.103 [C:\Program Files\dotnet\sdk]
  2.1.202 [C:\Program Files\dotnet\sdk]
  2.1.300-preview2-008533 [C:\Program Files\dotnet\sdk]
  2.1.302 [C:\Program Files\dotnet\sdk]
  2.1.401 [C:\Program Files\dotnet\sdk]
  2.1.402 [C:\Program Files\dotnet\sdk]
  2.1.403 [C:\Program Files\dotnet\sdk]
  2.1.500 [C:\Program Files\dotnet\sdk]
  2.1.504 [C:\Program Files\dotnet\sdk]
  2.1.505 [C:\Program Files\dotnet\sdk]
  2.1.602 [C:\Program Files\dotnet\sdk]
  2.1.604 [C:\Program Files\dotnet\sdk]
  2.1.700 [C:\Program Files\dotnet\sdk]
  2.1.801 [C:\Program Files\dotnet\sdk]
  2.1.802 [C:\Program Files\dotnet\sdk]
  2.2.100-preview1-009349 [C:\Program Files\dotnet\sdk]
  2.2.100-preview2-009404 [C:\Program Files\dotnet\sdk]
  2.2.100-preview3-009430 [C:\Program Files\dotnet\sdk]
  2.2.100 [C:\Program Files\dotnet\sdk]
  2.2.102 [C:\Program Files\dotnet\sdk]
  2.2.202 [C:\Program Files\dotnet\sdk]
  2.2.203 [C:\Program Files\dotnet\sdk]
  2.2.204 [C:\Program Files\dotnet\sdk]
  2.2.300 [C:\Program Files\dotnet\sdk]
  2.2.401 [C:\Program Files\dotnet\sdk]
  2.2.402 [C:\Program Files\dotnet\sdk]
  3.0.100-preview3-010431 [C:\Program Files\dotnet\sdk]
  3.0.100 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.0-preview2-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0-preview1-35029 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0-preview2-35157 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0-preview3-35497 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.0-preview2-final [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0-preview1-35029 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0-preview2-35157 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0-preview3-35497 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.2.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs:
  https://aka.ms/dotnet-download

• The IDE (VS / VS Code/ VS4Mac) you're running on, and it's version

I'm using VS Code 1.39.2

Version: 1.39.2 (user setup)
Commit: 6ab598523be7a800d7f3eb4d92d7ab9a66069390
Date: 2019-10-15T15:35:18.241Z
Electron: 4.2.10
Chrome: 69.0.3497.128
Node.js: 10.11.0
V8: 6.9.427.31-electron.0
OS: Windows_NT x64 10.0.18362

[javiercn]

@newbienewbie thanks for contacting us.

Can you provide a minimal repro project that illustrates the issue so that we can investigate?

[newbienewbie]

@javiercn See https://github.com/newbienewbie/AspNetCore_Demo_16840

[Oninaig]

Just wanted to chime in and say that while the workaround described by OP will work for his specific case, I am also running into his same error when trying to navigate to URLs that contain "invalid" characters when the URL itself was copied and pasted from a URL provided by NavigationManager.

Example (using server-side blazor): I have a button on a particular component that navigates to http://mysite/logs/2019/11/13/[$LATEST]4171e28aed6241119414ad912398d5a4. When you click on this button in the browser, you are navigated to that log without issue and the URL in the address bar is not encoded so it looks identical to the one above. However, if I copy-paste that URL into a new tab, navigation fails and I just get a white screen with the console saying: Error: The uris provided are invalid. at blazor.server.js:15.

I've been doing a lot of research on how to properly intercept and handle blazor server-side navigation so I can try to verify that URLs are encoded before navigation proceeds, but even with middleware and custom rewrite rules (in code), those requests are never intercepted except for on the original request. If the user is _already_ on the site and they click to navigate to an unencoded URL, the middleware and rules are never triggered since the navigation is being handled by SignalR.

It would be nice to be able to have some hook that enabled us to intercept server-side navigation so that we can add custom handlers to check for various conditions of a server-side request.

[sven5]

Hi @javiercn,
do you have any updates on this? Still no solution for this bug?

Edit: I played around with this and found out that there must be something wrong when calling the StartCircuit in ComponentHub

We see the following debug log entries:

dbug: Microsoft.AspNetCore.SignalR.Internal.DefaultHubDispatcher[1]

      Received hub invocation: InvocationMessage { InvocationId: "0", Target: "StartCircuit", Arguments: [ https://localhost:44367/, https://localhost:44367/something/k%C3%BChl/Test%2C%20Space, [{"type":"server","sequence":0,"descriptor":"CfDJ8PMQy0FCV2RAiCa/ONHvBpEH+9S3WUz7WKzrv9mWxqWDYCRE8PXHeSPM/3LhRut/PgrkV/LmsYGtCclAFPXomEWY6WqAqgU/pVJ5Q/27rItIY+3TVjHdZpRvG6dMDKH6xudTLYpbEvfWjnsrpKpnITYLzv3C7U8gdKCe725KSdYYdOlpBTHMXssUUe9ABpo8oax+wS7UDHP01Ko4YwSJDV4KuRQIHfo9QNPSLRq13xBNeBcVOqCpLVyCWrxMLoMrnOwX9kQq1wGvT5JYhge308fuSVdFKzt59ne79rsbx4Bs04VyGJgaia2NYEy721XnKr/BxHxsEe+2rpOMAg1SS3U80EvS4VYle9zpC3Vqo5ZrRu+Ts8vh2gEXhCIoV7T2BA=="}] ], StreamIds: [  ] }.

dbug: Microsoft.AspNetCore.Components.Server.ComponentHub[5]

      Call to 'StartCircuit' received invalid input data

dbug: Microsoft.AspNetCore.SignalR.HubConnectionHandler[6]

      OnConnectedAsync ending.

However, when checking the arguments for a valid Uri like StartCircuits does - it's a well-formed Uri.

The main culprit in my findings is when calling the url client-side by just clicking on a link it's working. But when manually copy&pasting the url in the browser the error comes up even with the very same Uri.

[sven5]

@mkArtakMSFT
Any news here ❓
It seems to be a bug, please fix this. We're using search friendly URLs and need a fix for this.

Thanks

[msftbot[bot]]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[aegirorn]

I am having exactly the same problem. I would think, making Blazor usable in non-English languages would be an important issue.

[mkArtakMSFT]

Closing this as a dupe of the referenced runtime issue.

[captainsafia]

Re-opening since @barahonajmc just discovered that validations on relative and absolute URLs behave differently and we need to use a different method to ensure consistency here.

[pranavkm]

Resolved as part of https://github.com/dotnet/aspnetcore/pull/26769