Newline character at the end of url shows some interesting stack trace

ServiceStack Debugging
1

One customer accidentally had a newline character at the end of the url he was using.

This resulted in some interesting stacktrace

I have no Idea if this is a bug or poses some security risks or not. Just wanted to let you know

So If I use postman and import this curl

curl --location 'http://localhost:55070/api
' \
--header 'Content-Type: application/json' \
--data '{
  "someData": "yes" 
}'

I get the following back

StorageException: Bad Request
StackTrace:
   at ServiceStack.TaskExt.GetResult(Task task) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack.Common/TaskExt.cs:line 54
   at ServiceStack.TaskExt.GetResult[T](Task`1 task) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack.Common/TaskExt.cs:line 60
   at ServiceStack.Azure.Storage.CloudBlobContainerExtension.Exists(CloudBlob blob) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack.Azure/src/ServiceStack.Azure/Storage/CloudBlobContainerExtension.cs:line 88
   at ServiceStack.Azure.Storage.AzureBlobVirtualFiles.GetFile(String virtualPath) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack.Azure/src/ServiceStack.Azure/Storage/AzureBlobVirtualFiles.cs:line 112
   at ServiceStack.IO.MultiVirtualFiles.<>c__DisplayClass15_0.<GetFile>b__0(IVirtualPathProvider childProvider) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack.Common/IO/MultiVirtualFiles.cs:line 50
   at System.Linq.Enumerable.SelectListIterator`2.MoveNext()
   at System.Linq.Enumerable.TryGetFirst[TSource](IEnumerable`1 source, Func`2 predicate, Boolean& found)
   at System.Linq.Enumerable.FirstOrDefault[TSource](IEnumerable`1 source, Func`2 predicate)
   at ServiceStack.IO.MultiVirtualFiles.GetFile(String virtualPath) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack.Common/IO/MultiVirtualFiles.cs:line 50
   at ServiceStack.Host.NetCore.NetCoreRequest.GetFile() in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/Host/NetCore/NetCoreRequest.cs:line 303
   at ServiceStack.Host.NetCore.NetCoreRequest.get_IsFile() in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/Host/NetCore/NetCoreRequest.cs:line 330
   at ServiceStack.RequestExtensions.IsFile(IRequest request) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/RequestExtensions.cs:line 274
   at ServiceStack.VirtualFilesFeature.GetHandler(IRequest httpReq) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/VirtualFilesFeature.cs:line 28
   at ServiceStack.ServiceStackHost.GetFallbackHandler(IHttpRequest httpReq) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/ServiceStackHost.Runtime.cs:line 540
   at ServiceStack.HttpHandlerFactory.GetHandlerForPathInfo(IHttpRequest httpReq, String filePath) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/HttpHandlerFactory.cs:line 280
   at ServiceStack.HttpHandlerFactory.GetHandlerInternal(IHttpRequest httpReq) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/HttpHandlerFactory.cs:line 258
   at ServiceStack.HttpHandlerFactory.GetHandler(IHttpRequest httpReq) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/HttpHandlerFactory.cs:line 214
   at ServiceStack.AppHostBase.ProcessRequest(HttpContext context, Func`1 next) in /home/runner/work/ServiceStack/ServiceStack/ServiceStack/src/ServiceStack/AppHostBase.NetCore.cs:line 449
2

Since the path doesn’t match a configured route it falls back to checking if path resolves to a valid file name. ServiceStack looks at Path.GetInvalidFileNameChars() to determine if it contains any invalid chars which doesn’t include \n since it’s valid in most Linux and most unix systems.

3

Ah I see. Thanks for the explanation.