diff --git a/src/MvcSiteMapProvider/MvcSiteMapProvider.Tests/Unit/Web/UrlPathTest.cs b/src/MvcSiteMapProvider/MvcSiteMapProvider.Tests/Unit/Web/UrlPathTest.cs index bc6d8073..18eec79f 100644 --- a/src/MvcSiteMapProvider/MvcSiteMapProvider.Tests/Unit/Web/UrlPathTest.cs +++ b/src/MvcSiteMapProvider/MvcSiteMapProvider.Tests/Unit/Web/UrlPathTest.cs @@ -89,6 +89,21 @@ public void IsAbsoluteUrl_WithAbsoluteUrl_ShouldReturnTrue() Assert.AreEqual(expected, actual); } + [Test] + public void IsAbsoluteUrl_WithAbsoluteUrlAsQueryParameter_ShouldReturnFalse() + { + // arrange + var target = this.NewUrlPath(); + + // act + var result = target.IsAbsoluteUrl(@"/error/pagenotfound?404;http://somewhere.com/directory/subdirectory/page.aspx?a=b"); + + // assert + var actual = result; + var expected = false; + Assert.AreEqual(expected, actual); + } + /// /// Return false when the virtual application name (and host name) match. /// diff --git a/src/MvcSiteMapProvider/MvcSiteMapProvider/Web/UrlPath.cs b/src/MvcSiteMapProvider/MvcSiteMapProvider/Web/UrlPath.cs index 0939be97..3f2554ba 100644 --- a/src/MvcSiteMapProvider/MvcSiteMapProvider/Web/UrlPath.cs +++ b/src/MvcSiteMapProvider/MvcSiteMapProvider/Web/UrlPath.cs @@ -4,6 +4,7 @@ using System.Globalization; using System.Linq; using System.Text; +using System.Text.RegularExpressions; using System.Web; using MvcSiteMapProvider.Web.Mvc; @@ -363,8 +364,14 @@ public string UrlDecode(string url) /// true if the URL is absolute; otherwise false. public bool IsAbsoluteUrl(string url) { - // There must be at least 1 character before the scheme delimiter. - return (url.IndexOf(Uri.SchemeDelimiter) > 0); + // Optimization: Return false early if there is no scheme delimiter in the string + // prefixed by at least 1 character. + if (!(url.IndexOf(Uri.SchemeDelimiter) > 0)) + return false; + + // There must be at least 1 word character before the scheme delimiter. + // This ensures we don't return true for query strings that contain absolute URLs. + return Regex.IsMatch(url, @"^\w+://", RegexOptions.Compiled); } ///