Merge pull request #1526 from mabako/escape-routeprefix

escape swaggerui route prefix when used in regexes
domaindrivendev · Mar 20, 2020 · 21f4bfe · 21f4bfe
2 parents e33dba2 + b57c9c8
commit 21f4bfe
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/Swashbuckle.AspNetCore.SwaggerUI/SwaggerUIMiddleware.cs b/src/Swashbuckle.AspNetCore.SwaggerUI/SwaggerUIMiddleware.cs
@@ -50,7 +50,7 @@ public async Task Invoke(HttpContext httpContext)
             var path = httpContext.Request.Path.Value;
 
             // If the RoutePrefix is requested (with or without trailing slash), redirect to index URL
-            if (httpMethod == "GET" && Regex.IsMatch(path, $"^/{_options.RoutePrefix}/?$"))
+            if (httpMethod == "GET" && Regex.IsMatch(path, $"^/{Regex.Escape(_options.RoutePrefix)}/?$"))
             {
                 // Use relative redirect to support proxy environments
                 var relativeRedirectPath = path.EndsWith("/")
@@ -61,7 +61,7 @@ public async Task Invoke(HttpContext httpContext)
                 return;
             }
 
-            if (httpMethod == "GET" && Regex.IsMatch(path, $"^/{_options.RoutePrefix}/?index.html$"))
+            if (httpMethod == "GET" && Regex.IsMatch(path, $"^/{Regex.Escape(_options.RoutePrefix)}/?index.html$"))
             {
                 await RespondWithIndexHtml(httpContext.Response);
                 return;