System.Uri.ToString() throws despite Uri.TryCreate succeeding

[zotanmew]

Description

Uri.ToString throws ArgumentOutOfRangeException for some inputs that pass Uri.TryCreate. Same behavior for .Host, .AbsoluteUri, etc:

Reproduction Steps

if (Uri.TryCreate("\t/�", UriKind.Absolute, out var uri)) {
    Console.WriteLine(uri.ToString()); // throws ArgumentOutOfRangeException
}

Expected behavior

Either for Uri.TryCreate to fail, or for uri.ToString() to succeed

Actual behavior

System.ArgumentOutOfRangeException: length ('-8') must be a non-negative value. (Parameter 'length')
Actual value was -8.
   at System.ArgumentOutOfRangeException.ThrowNegative[T](T value, String paramName)
   at System.ArgumentOutOfRangeException.ThrowIfNegative[T](T value, String paramName)
   at System.String.ThrowSubstringArgumentOutOfRange(Int32 startIndex, Int32 length)
   at System.String.Substring(Int32 startIndex, Int32 length)
   at System.Uri.CreateHostStringHelper(String str, Int32 idx, Int32 end, Flags& flags, String& scopeId)
   at System.Uri.CreateHostString()
   at System.Uri.GetComponentsHelper(UriComponents uriComponents, UriFormat uriFormat)
   at System.Uri.ToString()

The negative number seems to depend on how many leading tab characters the input string has.

Regression?

.NET Core 3.1: uri.ToString() → file://%EF%BF%BD/%25EF%25BF%25BD
Any later .NET version (from .NET 5 onwards): ArgumentOutOfRangeException at ToString()

Known Workarounds

• if (Uri.TryCreate(..., out var uri) && uri is { Scheme: "http" or "https" })
• if (Uri.TryCreate(..., out var uri) && uri is { Scheme: not "file" })

Configuration

.NET 9.0.0, macOS 15.1.1 arm64

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[zotanmew]

This was found during a fuzzing pass on a parser I wrote, the original input the fuzzer used was \t\t\t\t\t\t\t\t/s�:<G$[hcom

[kescherCode]

For comparison purposes: .NET Framework 4.x refuses to create the Uri to begin with. However, that's because it doesn't parse absolute paths to file:// URIs to begin with.

[MihaZupan]

Thanks for the report.
Implicit file path support, the gift that keeps on giving.

After EnsureUriInfo we're looking at:

_string "\t/�"

_info.Offset
    End: 3
    Fragment: 0
    Host: 1
    Path: 1
    PortValue: 0
    Query: 0
    Scheme: 1
    User: 1

and after ParseRemaining:

_string "/%EF%BF%BD"

_info.Offset
    End: 10
    Fragment: 10
    Host: 1
    Path: 0
    PortValue: 0
    Query: 10
    Scheme: 1
    User: 1

Note that we've updated Path = 0 as we've realized there's no host, but we never fix up the Host = 1 offset.

runtime/src/libraries/System.Private.Uri/src/System/Uri.cs

Lines 3285 to 3304 in e7e568b

	if (buildIriStringFromPath)
	{
	DebugAssertInCtor();
	// Dos/Unix paths have no host. Other schemes cleared/set _string with host information in PrivateParseMinimal.
	if (IsFile && !IsUncPath)
	{
	if (IsImplicitFile)
	{
	_string = string.Empty;
	}
	else
	{
	_string = _syntax.SchemeName + SchemeDelimiter;
	}
	}
	_info.Offset.Path = (ushort)_string.Length;
	idx = _info.Offset.Path;
	}

And once we reach the host helper, we're calling it with idx = 1, end = 0:

runtime/src/libraries/System.Private.Uri/src/System/Uri.cs

Line 2437 in e7e568b

string host = CreateHostStringHelper(_string, _info.Offset.Host, _info.Offset.Path, ref flags, ref _info.ScopeId);

If you don't have leading whitespace in the input, Host remains 0, and you only "allocate" an empty substring for the host.