Merge pull request #836 from dotnet-maestro-bot/merge/release/2.2-to-master

[automated] Merge branch 'release/2.2' => 'master'

Author: rynowak

src/Microsoft.AspNetCore.Routing.Abstractions/LinkGenerationTemplate.cs

@@ -63,6 +63,7 @@ public abstract string GetPath(
         /// </param>
         /// <param name="host">
         /// The URI host/authority, applied to the resulting URI. Optional. If not provided, the value <see cref="HttpRequest.Host"/> will be used.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
         /// </param>
         /// <param name="pathBase">
         /// An optional URI path base. Prepended to the path in the resulting URI. If not provided, the value of <see cref="HttpRequest.PathBase"/> will be used.
@@ -73,6 +74,14 @@ public abstract string GetPath(
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>A URI with an absolute path, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public abstract string GetUri(
             HttpContext httpContext,
             object values,
@@ -87,14 +96,25 @@ public abstract string GetUri(
         /// </summary>
         /// <param name="values">The route values. Used to expand parameters in the route template. Optional.</param>
         /// <param name="scheme">The URI scheme, applied to the resulting URI.</param>
-        /// <param name="host">The URI host/authority, applied to the resulting URI.</param>
+        /// <param name="host">
+        /// The URI host/authority, applied to the resulting URI.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
+        /// </param>
         /// <param name="pathBase">An optional URI path base. Prepended to the path in the resulting URI.</param>
         /// <param name="fragment">An optional URI fragment. Appended to the resulting URI.</param>
         /// <param name="options">
         /// An optional <see cref="LinkOptions"/>. Settings on provided object override the settings with matching
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>An absolute URI, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public abstract string GetUri(
             object values,
             string scheme,

src/Microsoft.AspNetCore.Routing.Abstractions/LinkGenerator.cs

@@ -83,6 +83,7 @@ public abstract string GetPathByAddress<TAddress>(
         /// </param>
         /// <param name="host">
         /// The URI host/authority, applied to the resulting URI. Optional. If not provided, the value <see cref="HttpRequest.Host"/> will be used.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
         /// </param>
         /// <param name="pathBase">
         /// An optional URI path base. Prepended to the path in the resulting URI. If not provided, the value of <see cref="HttpRequest.PathBase"/> will be used.
@@ -93,6 +94,14 @@ public abstract string GetPathByAddress<TAddress>(
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>A URI with an absolute path, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public abstract string GetUriByAddress<TAddress>(
             HttpContext httpContext,
             TAddress address,
@@ -111,14 +120,25 @@ public abstract string GetUriByAddress<TAddress>(
         /// <param name="address">The address value. Used to resolve endpoints.</param>
         /// <param name="values">The route values. Used to expand parameters in the route template. Optional.</param>
         /// <param name="scheme">The URI scheme, applied to the resulting URI.</param>
-        /// <param name="host">The URI host/authority, applied to the resulting URI.</param>
+        /// <param name="host">
+        /// The URI host/authority, applied to the resulting URI.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
+        /// </param>
         /// <param name="pathBase">An optional URI path base. Prepended to the path in the resulting URI.</param>
         /// <param name="fragment">An optional URI fragment. Appended to the resulting URI.</param>
         /// <param name="options">
         /// An optional <see cref="LinkOptions"/>. Settings on provided object override the settings with matching
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>An absolute URI, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public abstract string GetUriByAddress<TAddress>(
             TAddress address,
             RouteValueDictionary values,

src/Microsoft.AspNetCore.Routing/LinkGeneratorEndpointNameAddressExtensions.cs

@@ -112,6 +112,7 @@ public static string GetPathByName(
         /// </param>
         /// <param name="host">
         /// The URI host/authority, applied to the resulting URI. Optional. If not provided, the value <see cref="HttpRequest.Host"/> will be used.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
         /// </param>
         /// <param name="pathBase">
         /// An optional URI path base. Prepended to the path in the resulting URI. If not provided, the value of <see cref="HttpRequest.PathBase"/> will be used.
@@ -122,6 +123,14 @@ public static string GetPathByName(
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>A URI with an absolute path, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public static string GetUriByName(
             this LinkGenerator generator,
             HttpContext httpContext,
@@ -167,14 +176,25 @@ public static string GetUriByName(
         /// <param name="endpointName">The endpoint name. Used to resolve endpoints.</param>
         /// <param name="values">The route values. Used to expand parameters in the route template. Optional.</param>
         /// <param name="scheme">The URI scheme, applied to the resulting URI.</param>
-        /// <param name="host">The URI host/authority, applied to the resulting URI.</param>
+        /// <param name="host">
+        /// The URI host/authority, applied to the resulting URI.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
+        /// </param>
         /// <param name="pathBase">An optional URI path base. Prepended to the path in the resulting URI.</param>
         /// <param name="fragment">An optional URI fragment. Appended to the resulting URI.</param>
         /// <param name="options">
         /// An optional <see cref="LinkOptions"/>. Settings on provided object override the settings with matching
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>An absolute URI, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public static string GetUriByName(
             this LinkGenerator generator,
             string endpointName,

src/Microsoft.AspNetCore.Routing/LinkGeneratorRouteValuesAddressExtensions.cs

@@ -104,6 +104,7 @@ public static string GetPathByRouteValues(
         /// </param>
         /// <param name="host">
         /// The URI host/authority, applied to the resulting URI. Optional. If not provided, the value <see cref="HttpRequest.Host"/> will be used.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
         /// </param>
         /// <param name="pathBase">
         /// An optional URI path base. Prepended to the path in the resulting URI. If not provided, the value of <see cref="HttpRequest.PathBase"/> will be used.
@@ -114,6 +115,14 @@ public static string GetPathByRouteValues(
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>A URI with an absolute path, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public static string GetUriByRouteValues(
             this LinkGenerator generator,
             HttpContext httpContext,
@@ -155,14 +164,25 @@ public static string GetUriByRouteValues(
         /// <param name="routeName">The route name. Used to resolve endpoints. Optional.</param>
         /// <param name="values">The route values. Used to resolve endpoints and expand parameters in the route template. Optional.</param>
         /// <param name="scheme">The URI scheme, applied to the resulting URI.</param>
-        /// <param name="host">The URI host/authority, applied to the resulting URI.</param>
+        /// <param name="host">
+        /// The URI host/authority, applied to the resulting URI.
+        /// See the remarks section for details about the security implications of the <paramref name="host"/>.
+        /// </param>
         /// <param name="pathBase">An optional URI path base. Prepended to the path in the resulting URI.</param>
         /// <param name="fragment">An optional URI fragment. Appended to the resulting URI.</param>
         /// <param name="options">
         /// An optional <see cref="LinkOptions"/>. Settings on provided object override the settings with matching
         /// names from <c>RouteOptions</c>.
         /// </param>
         /// <returns>An absolute URI, or <c>null</c>.</returns>
+        /// <remarks>
+        /// <para>
+        /// The value of <paramref name="host" /> should be a trusted value. Relying on the value of the current request
+        /// can allow untrusted input to influence the resulting URI unless the <c>Host</c> header has been validated.
+        /// See the deployment documentation for instructions on how to properly validate the <c>Host</c> header in
+        /// your deployment environment.
+        /// </para>
+        /// </remarks>
         public static string GetUriByRouteValues(
             this LinkGenerator generator,
             string routeName,