Collapse scheme-relative leading slashes in Rewrite middleware redirect/rewrite targets

src/Middleware/Rewrite/src/RedirectRule.cs

@@ -43,6 +43,7 @@ public void ApplyRule(RewriteContext context)
         if (initMatchResults.Success)
         {
             var newPath = initMatchResults.Result(Replacement);
+            newPath = UrlNormalizer.CollapseLeadingSlashes(newPath);
             var response = context.HttpContext.Response;
 
             response.StatusCode = StatusCode;

src/Middleware/Rewrite/src/UrlActions/RedirectAction.cs

@@ -43,6 +43,8 @@ public override void ApplyAction(RewriteContext context, BackReferenceCollection
             return;
         }
 
+        pattern = UrlNormalizer.CollapseLeadingSlashes(pattern);
+
         if (!pattern.Contains(Uri.SchemeDelimiter, StringComparison.Ordinal) && pattern[0] != '/')
         {
             pattern = '/' + pattern;
@@ -51,7 +53,6 @@ public override void ApplyAction(RewriteContext context, BackReferenceCollection
 
         // url can either contain the full url or the path and query
         // always add to location header.
-        // TODO check for false positives
 
         var split = pattern.IndexOf('?');
         if (split >= 0 && QueryStringAppend)

src/Middleware/Rewrite/src/UrlActions/RewriteAction.cs

@@ -58,6 +58,12 @@ public override void ApplyAction(RewriteContext context, BackReferenceCollection
             pattern = Uri.EscapeDataString(pattern);
         }
 
+        // Defense in depth: this rule does not emit a Location header itself, but the rewritten value is
+        // assigned to Request.Path below and a downstream component (or a later rule) may issue a redirect
+        // from it. PathString does not reject a leading '//' or '/\', so neutralize the scheme-relative
+        // shape here rather than auditing every downstream consumer.
+        pattern = UrlNormalizer.CollapseLeadingSlashes(pattern);
+
         // TODO PERF, substrings, object creation, etc.
         if (pattern.Contains(Uri.SchemeDelimiter, StringComparison.Ordinal))
         {

src/Middleware/Rewrite/src/UrlNormalizer.cs

@@ -0,0 +1,25 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.AspNetCore.Rewrite;
+
+internal static class UrlNormalizer
+{
+    // Collapses a leading run of '/' and '\' to a single '/' so a redirect/rewrite target cannot resolve as a
+    // scheme-relative authority. Mirrors the rejection predicate in SharedUrlHelper.IsLocalUrl.
+    public static string CollapseLeadingSlashes(string url)
+    {
+        if (url.Length < 2 || url[0] != '/' || (url[1] != '/' && url[1] != '\\'))
+        {
+            return url;
+        }
+
+        var i = 1;
+        while (i < url.Length && (url[i] == '/' || url[i] == '\\'))
+        {
+            i++;
+        }
+
+        return i == url.Length ? "/" : string.Concat("/", url.AsSpan(i));
+    }
+}

src/Middleware/Rewrite/test/ApacheModRewrite/ModRewriteMiddlewareTest.cs

@@ -37,6 +37,62 @@ public async Task Invoke_RewritePathWhenMatching()
         Assert.Equal("/hello", response);
     }
 
+    [Theory]
+    [InlineData("/legacy//example.com")]
+    [InlineData("/legacy///example.com")]
+    [InlineData(@"/legacy/\example.com")]
+    public async Task Invoke_RedirectCollapsesSchemeRelativeBackReference(string requestPath)
+    {
+        var options = new RewriteOptions().AddApacheModRewrite(new StringReader("RewriteRule /legacy/(.*) /$1 [R=302,L]"));
+        using var host = new HostBuilder()
+            .ConfigureWebHost(webHostBuilder =>
+            {
+                webHostBuilder
+                .UseTestServer()
+                .Configure(app =>
+                {
+                    app.UseRewriter(options);
+                    app.Run(context => context.Response.WriteAsync(context.Response.Headers.Location));
+                });
+            }).Build();
+
+        await host.StartAsync();
+
+        var server = host.GetTestServer();
+
+        var response = await server.CreateClient().GetAsync(requestPath);
+
+        Assert.Equal("/example.com", response.Headers.Location.OriginalString);
+    }
+
+    [Theory]
+    [InlineData("/legacy//example.com")]
+    [InlineData("/legacy///example.com")]
+    [InlineData(@"/legacy/\example.com")]
+    public async Task Invoke_RewriteCollapsesSchemeRelativeBackReference(string requestPath)
+    {
+        var options = new RewriteOptions().AddApacheModRewrite(new StringReader("RewriteRule /legacy/(.*) /$1"));
+        using var host = new HostBuilder()
+            .ConfigureWebHost(webHostBuilder =>
+            {
+                webHostBuilder
+                .UseTestServer()
+                .Configure(app =>
+                {
+                    app.UseRewriter(options);
+                    app.Run(context => context.Response.WriteAsync(context.Request.Path));
+                });
+            }).Build();
+
+        await host.StartAsync();
+
+        var server = host.GetTestServer();
+
+        var response = await server.CreateClient().GetStringAsync(requestPath);
+
+        Assert.Equal("/example.com", response);
+    }
+
     [Fact]
     public async Task Invoke_RewritePathTerminatesOnFirstSuccessOfRule()
     {

src/Middleware/Rewrite/test/IISUrlRewrite/MiddleWareTests.cs

@@ -47,6 +47,41 @@ public async Task Invoke_RedirectPathToPathAndQuery()
         Assert.Equal("/article.aspx?id=10&title=hey", response.Headers.Location.OriginalString);
     }
 
+    [Theory]
+    [InlineData("legacy//example.com")]
+    [InlineData("legacy///example.com")]
+    [InlineData(@"legacy/\example.com")]
+    public async Task Invoke_RedirectCollapsesSchemeRelativeBackReference(string requestPath)
+    {
+        var options = new RewriteOptions().AddIISUrlRewrite(new StringReader(@"<rewrite>
+                <rules>
+                <rule name=""Collapse"">
+                <match url=""^legacy/(.*)"" />
+                <action type=""Redirect"" url=""/{R:1}"" redirectType=""Found"" />
+                </rule>
+                </rules>
+                </rewrite>"));
+        using var host = new HostBuilder()
+             .ConfigureWebHost(webHostBuilder =>
+             {
+                 webHostBuilder
+                 .UseTestServer()
+                 .Configure(app =>
+                 {
+                     app.UseRewriter(options);
+                     app.Run(context => context.Response.WriteAsync(context.Response.Headers.Location));
+                 });
+             }).Build();
+
+        await host.StartAsync();
+
+        var server = host.GetTestServer();
+
+        var response = await server.CreateClient().GetAsync(requestPath);
+
+        Assert.Equal("/example.com", response.Headers.Location.OriginalString);
+    }
+
     [Fact]
     public async Task Invoke_RewritePathToPathAndQuery()
     {

src/Middleware/Rewrite/test/MiddlewareTests.cs

@@ -174,6 +174,37 @@ public async Task CheckRedirectPath(string pattern, string replacement, string b
         Assert.Equal(expectedUrl, response.Headers.Location.OriginalString);
     }
 
+    [Theory]
+    [InlineData("(.*)", "//example.com", "anything")]
+    [InlineData("(.*)", "///example.com", "anything")]
+    [InlineData("(.*)", @"/\example.com", "anything")]
+    [InlineData("(.*)", "//////example.com", "anything")]
+    [InlineData("legacy/(.*)", "/$1", "legacy//example.com")]
+    [InlineData("legacy/(.*)", "/$1", "legacy///example.com")]
+    [InlineData("legacy/(.*)", "/$1", @"legacy/\example.com")]
+    public async Task CheckRedirect_CollapsesSchemeRelativeTarget(string pattern, string replacement, string requestUrl)
+    {
+        var options = new RewriteOptions().AddRedirect(pattern, replacement, statusCode: StatusCodes.Status302Found);
+        using var host = new HostBuilder()
+            .ConfigureWebHost(webHostBuilder =>
+            {
+                webHostBuilder
+                .UseTestServer()
+                .Configure(app =>
+                {
+                    app.UseRewriter(options);
+                });
+            }).Build();
+
+        await host.StartAsync();
+
+        var server = host.GetTestServer();
+
+        var response = await server.CreateClient().GetAsync(requestUrl);
+
+        Assert.Equal("/example.com", response.Headers.Location.OriginalString);
+    }
+
     [Fact]
     public async Task RewriteRulesCanComeFromConfigureOptions()
     {