[fix] address security & correctness audit findings

Critical
- StaticFiles: prevent path traversal by normalizing the resolved path with
  Path.GetFullPath, rejecting '..' / NUL sequences, and verifying containment
  inside the configured site root (case-insensitive on Windows/macOS).
  Both IsValidPath() and the data-reading methods now use the safe resolver.
- SimplifyWebSettings: default HideExceptionDetails to true so unhandled
  exception stack traces are no longer leaked to anonymous users by default.

High
- FilesInMemoryCache / InMemoryFilesCacheHandler: bound the in-memory cache
  (MaxItems, default 1024), normalize keys case-insensitively to defeat
  path case-variant OOM DoS, and invalidate stale entries based on the
  file's last-modification timestamp.
- FileReader: replace static Dictionary caches guarded by an external lock
  with ConcurrentDictionary to eliminate read-while-write corruption.
- TemplateFactory: replace Dictionary + dual lock/semaphore primitives with
  a ConcurrentDictionary cache and unify sync/async paths on a single
  SemaphoreSlim to avoid duplicate-add races.
- WebContext: pass leaveOpen:true to the StreamReader used to consume the
  request body so subsequent middleware/model binders can still read it;
  add double-check inside semaphore-guarded sections; implement IDisposable
  so per-scope semaphores release their kernel handles.

Medium
- Redirector: harden Redirect(string) - accept same-origin relative paths
  only when they start with '/' (rejecting '//' and '/\' scheme-spoofs)
  and compare absolute URLs by scheme+host+port instead of substring
  StartsWith. All redirect/login/previous-page cookies are now HttpOnly,
  SameSite=Lax, Secure.
- LanguageManager: language cookie switched from SameSite=None to Lax.
- ControllerMetadata: detect [Authorize] on base controllers (inherit:true)
  so derived controllers don't silently become anonymous.
- AuthRedirectExtensions: only issue the 401->redirect when the response
  has not started, avoiding InvalidOperationException 500s when upstream
  authentication middleware already flushed a challenge.

Tests
- Update RedirectorTests cases that relied on the old StartsWith-based
  redirect check to use realistic same-origin URLs.
- Add tests covering path-traversal rejection, protocol-relative open
  redirects, host-prefix collisions, relative-path acceptance, and the
  hardened cookie options.

Author: i4004

src/Simplify.Web.Tests/Modules/Redirection/RedirectorTests.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Security;
 using Microsoft.AspNetCore.Http;
 using Moq;
 using NUnit.Framework;
@@ -57,11 +58,9 @@ public void Redirect_ToRedirectUrlHaveRedirectUrl_RedirectCalledWithCorrectLinkP
 		// Arrange
 
 		var cookieCollection = new Mock<IRequestCookieCollection>();
-		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.RedirectUrlCookieFieldName)]).Returns("foo");
+		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.RedirectUrlCookieFieldName)]).Returns("http://localhost/my-website/foo");
 		_context.SetupGet(x => x.Request.Cookies).Returns(cookieCollection.Object);
 
-		_context.SetupGet(x => x.SiteUrl).Returns("foo");
-
 		_responseCookies.Setup(x => x.Append(It.IsAny<string>(), It.IsAny<string>())).Callback<string, string>((key, value) =>
 		{
 			Assert.That(key, Is.EqualTo(Redirector.PreviousNavigatedUrlCookieFieldName));
@@ -72,7 +71,7 @@ public void Redirect_ToRedirectUrlHaveRedirectUrl_RedirectCalledWithCorrectLinkP
 		_redirector.Redirect(RedirectionType.RedirectUrl);
 
 		// Assert
-		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "foo")), Times.Once);
+		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "http://localhost/my-website/foo")), Times.Once);
 	}
 
 	[Test]
@@ -101,16 +100,14 @@ public void Redirect_ToLoginReturnUrl_NotNullOrEmpty_LoginReturnUrl()
 		// Arrange
 
 		var cookieCollection = new Mock<IRequestCookieCollection>();
-		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.LoginReturnUrlCookieFieldName)]).Returns("loginFoo");
+		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.LoginReturnUrlCookieFieldName)]).Returns("http://localhost/my-website/loginFoo");
 		_context.SetupGet(x => x.Request.Cookies).Returns(cookieCollection.Object);
 
-		_context.SetupGet(x => x.SiteUrl).Returns("loginFoo");
-
 		// Act
 		_redirector.Redirect(RedirectionType.LoginReturnUrl);
 
 		// Assert
-		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "loginFoo")), Times.Once);
+		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "http://localhost/my-website/loginFoo")), Times.Once);
 	}
 
 	[Test]
@@ -119,16 +116,14 @@ public void Redirect_ToPreviousPageHavePreviousPageUrl_RedirectCalledWithCorrect
 		// Arrange
 
 		var cookieCollection = new Mock<IRequestCookieCollection>();
-		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.PreviousPageUrlCookieFieldName)]).Returns("foo");
+		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.PreviousPageUrlCookieFieldName)]).Returns("http://localhost/my-website/foo");
 		_context.SetupGet(x => x.Request.Cookies).Returns(cookieCollection.Object);
 
-		_context.SetupGet(x => x.SiteUrl).Returns("foo");
-
 		// Act
 		_redirector.Redirect(RedirectionType.PreviousPage);
 
 		// Assert
-		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "foo")), Times.Once);
+		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "http://localhost/my-website/foo")), Times.Once);
 	}
 
 	[Test]
@@ -137,16 +132,14 @@ public void Redirect_ToPreviousPageWithBookmarkHaveUrl_RedirectCalledWithCorrect
 		// Arrange
 
 		var cookieCollection = new Mock<IRequestCookieCollection>();
-		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.PreviousPageUrlCookieFieldName)]).Returns("foo");
+		cookieCollection.SetupGet(x => x[It.Is<string>(s => s == Redirector.PreviousPageUrlCookieFieldName)]).Returns("http://localhost/my-website/foo");
 		_context.SetupGet(x => x.Request.Cookies).Returns(cookieCollection.Object);
 
-		_context.SetupGet(x => x.SiteUrl).Returns("foo");
-
 		// Act
 		_redirector.Redirect(RedirectionType.PreviousPageWithBookmark, "bar");
 
 		// Assert
-		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "foo#bar")), Times.Once);
+		_context.Verify(x => x.Response.Redirect(It.Is<string>(c => c == "http://localhost/my-website/foo#bar")), Times.Once);
 	}
 
 	[Test]
@@ -239,4 +232,47 @@ public void SetPreviousPageUrl_Set()
 		// Act & Assert
 		_redirector.PreviousPageUrl = "foo";
 	}
+
+	[Test]
+	public void Redirect_ProtocolRelativeUrl_ThrowsSecurityException() =>
+		Assert.Throws<SecurityException>(() => _redirector.Redirect("//evil.com/path"));
+
+	[Test]
+	public void Redirect_BackslashSchemeSpoof_ThrowsSecurityException() =>
+		Assert.Throws<SecurityException>(() => _redirector.Redirect("/\\evil.com"));
+
+	[Test]
+	public void Redirect_HostPrefixCollision_ThrowsSecurityException()
+	{
+		// The old StartsWith-based check would have accepted "http://localhost.attacker.com/"
+		// because it shared the "http://localhost" prefix when SiteUrl lacked a trailing slash.
+		_context.SetupGet(x => x.SiteUrl).Returns("http://localhost");
+
+		Assert.Throws<SecurityException>(() => _redirector.Redirect("http://localhost.attacker.com/path"));
+	}
+
+	[Test]
+	public void Redirect_RelativePath_Allowed()
+	{
+		_redirector.Redirect("/some/internal/path");
+
+		_context.Verify(x => x.Response.Redirect("/some/internal/path"), Times.Once);
+	}
+
+	[Test]
+	public void SetPreviousPageUrl_AppendedCookieIsHttpOnlyAndLax()
+	{
+		CookieOptions? captured = null;
+
+		_context.SetupGet(x => x.Response.Cookies).Returns(_responseCookies.Object);
+		_responseCookies.Setup(x => x.Append(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CookieOptions>()))
+			.Callback<string, string, CookieOptions>((_, _, opts) => captured = opts);
+
+		_redirector.PreviousPageUrl = "anything";
+
+		Assert.That(captured, Is.Not.Null);
+		Assert.That(captured!.HttpOnly, Is.True);
+		Assert.That(captured.SameSite, Is.EqualTo(SameSiteMode.Lax));
+		Assert.That(captured.Secure, Is.True);
+	}
 }

src/Simplify.Web.Tests/StaticFiles/IO/StaticFileTests.cs

@@ -73,6 +73,31 @@ public void GetLastModificationTime_ValidFile_MillisecondsTrimmed()
 		Assert.That(result.Millisecond, Is.Zero);
 	}
 
+	[Test]
+	public void IsValidPath_ParentDirectoryTraversal_False()
+	{
+		// Act
+		var result = _staticFile.IsValidPath("staticfiles/../StaticFiles/IO/TestFiles/TestStaticFile.html");
+
+		// Assert
+		Assert.That(result, Is.False);
+	}
+
+	[Test]
+	public void IsValidPath_EncodedTraversalLooking_False()
+	{
+		// Act — ASP.NET Core decodes %2e%2e before this layer, so the raw '..' check fires.
+		var result = _staticFile.IsValidPath("staticfiles/../../../etc/passwd");
+
+		// Assert
+		Assert.That(result, Is.False);
+	}
+
+	[Test]
+	public void GetDataAsync_TraversalPath_Throws() =>
+		Assert.ThrowsAsync<UnauthorizedAccessException>(async () =>
+			await _staticFile.GetDataAsync("staticfiles/../StaticFiles/IO/TestFiles/TestStaticFile.html"));
+
 	[Test]
 	public async Task GetDataAsync_ValidFile_DataReturned()
 	{

src/Simplify.Web/Auth/Extensions/AuthRedirectExtensions.cs

@@ -17,7 +17,10 @@ public static void UseAuthRedirect(this IApplicationBuilder app, string redirect
 		{
 			await next();
 
-			if (context.Response.StatusCode == 401)
+			// Guard against InvalidOperationException ("StatusCode cannot be set, response
+			// has already started") that occurs when an upstream authentication handler
+			// already flushed a 401 challenge response body.
+			if (context.Response.StatusCode == 401 && !context.Response.HasStarted)
 				context.Response.Redirect(redirectUrl);
 		});
 }

src/Simplify.Web/Controllers/Meta/ControllerMetadata.cs

@@ -100,7 +100,7 @@ public abstract class ControllerMetadata(Type controllerType) : IControllerMetad
 		var isAuthorizationRequired = false;
 		IEnumerable<string>? requiredUserRoles = null;
 
-		var attributes = controllerType.GetCustomAttributes(typeof(AuthorizeAttribute), false);
+		var attributes = controllerType.GetCustomAttributes(typeof(AuthorizeAttribute), true);
 
 		if (attributes.Length > 0)
 		{

src/Simplify.Web/Modules/Context/WebContext.cs

@@ -1,5 +1,6 @@
-using System;
+using System;
 using System.IO;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Http;
@@ -10,13 +11,14 @@ namespace Simplify.Web.Modules.Context;
 /// Provides the web context.
 /// </summary>
 /// <seealso cref="IWebContext" />
-public sealed class WebContext : IWebContext
+public sealed class WebContext : IWebContext, IDisposable
 {
 	private readonly SemaphoreSlim _formReadSemaphore = new(1, 1);
 	private readonly SemaphoreSlim _requestBodyReadSemaphore = new(1, 1);
 
 	private IFormCollection? _form;
 	private string? _requestBody;
+	private bool _disposed;
 
 	/// <summary>
 	/// Initializes a new instance of the <see cref="WebContext" /> class.
@@ -164,6 +166,9 @@ public async Task ReadFormAsync()
 
 		try
 		{
+			if (_form != null)
+				return;
+
 			_form = await Context.Request.ReadFormAsync();
 		}
 		finally
@@ -184,7 +189,16 @@ public async Task ReadRequestBodyAsync()
 
 		try
 		{
-			using var reader = new StreamReader(Context.Request.Body);
+			if (_requestBody != null)
+				return;
+
+			// Keep the underlying request stream open so that other middleware /
+			// model binders downstream can still consume the body if it is buffered.
+#if NETSTANDARD2_0 || NETSTANDARD2_1
+			using var reader = new StreamReader(Context.Request.Body, Encoding.UTF8, detectEncodingFromByteOrderMarks: true, bufferSize: 1024, leaveOpen: true);
+#else
+			using var reader = new StreamReader(Context.Request.Body, leaveOpen: true);
+#endif
 
 			_requestBody = await reader.ReadToEndAsync();
 		}
@@ -193,4 +207,19 @@ public async Task ReadRequestBodyAsync()
 			_requestBodyReadSemaphore.Release();
 		}
 	}
+
+	/// <summary>
+	/// Releases unmanaged resources held by the web context (the semaphores used to
+	/// serialize body / form reads).
+	/// </summary>
+	public void Dispose()
+	{
+		if (_disposed)
+			return;
+
+		_disposed = true;
+
+		_formReadSemaphore.Dispose();
+		_requestBodyReadSemaphore.Dispose();
+	}
 }

src/Simplify.Web/Modules/Data/FileReader.cs

@@ -1,7 +1,7 @@
-using System;
+using System;
+using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
-using System.Linq;
 using System.Xml.Linq;
 using Simplify.Web.Modules.Localization;
 
@@ -21,13 +21,9 @@ namespace Simplify.Web.Modules.Data;
 public sealed class FileReader(string dataPhysicalPath, string defaultLanguage, ILanguageManagerProvider languageManagerProvider,
 	bool disableCache = false) : IFileReader
 {
-	private static readonly IDictionary<KeyValuePair<string, string>, XDocument?> XmlCache =
-		new Dictionary<KeyValuePair<string, string>, XDocument?>();
+	private static readonly ConcurrentDictionary<KeyValuePair<string, string>, XDocument?> XmlCache = new();
 
-	private static readonly IDictionary<KeyValuePair<string, string>, string?> TextCache =
-		new Dictionary<KeyValuePair<string, string>, string?>();
-
-	private static readonly object Locker = new();
+	private static readonly ConcurrentDictionary<KeyValuePair<string, string>, string?> TextCache = new();
 
 	private ILanguageManager _languageManager = null!;
 
@@ -36,11 +32,8 @@ public sealed class FileReader(string dataPhysicalPath, string defaultLanguage,
 	/// </summary>
 	public static void ClearCache()
 	{
-		lock (Locker)
-		{
-			XmlCache.Clear();
-			TextCache.Clear();
-		}
+		XmlCache.Clear();
+		TextCache.Clear();
 	}
 
 	/// <summary>
@@ -173,33 +166,11 @@ public string GetFilePath(string? fileName, string? language)
 
 	#endregion XML
 
-	private static bool TryToLoadTextFileFromCache(string fileName, string language, out string? data)
-	{
-		data = null;
-
-		var cacheItem = TextCache.FirstOrDefault(x => x.Key.Key == fileName && x.Key.Value == language);
-
-		if (cacheItem.Equals(default(KeyValuePair<KeyValuePair<string, string>, string>)))
-			return false;
-
-		data = cacheItem.Value;
+	private static bool TryToLoadTextFileFromCache(string fileName, string language, out string? data) =>
+		TextCache.TryGetValue(new KeyValuePair<string, string>(fileName, language), out data);
 
-		return true;
-	}
-
-	private static bool TryToLoadXDocumentFromCache(string fileName, string language, out XDocument? data)
-	{
-		data = null;
-
-		var cacheItem = XmlCache.FirstOrDefault(x => x.Key.Key == fileName && x.Key.Value == language);
-
-		if (cacheItem.Equals(default(KeyValuePair<KeyValuePair<string, string>, XDocument>)))
-			return false;
-
-		data = cacheItem.Value;
-
-		return true;
-	}
+	private static bool TryToLoadXDocumentFromCache(string fileName, string language, out XDocument? data) =>
+		XmlCache.TryGetValue(new KeyValuePair<string, string>(fileName, language), out data);
 
 	private bool LoadTextFileFromFileSystem(string fileName, string language, out string? data)
 	{
@@ -220,18 +191,12 @@ private bool LoadTextFileCached(string fileName, string language, out string? da
 		if (TryToLoadTextFileFromCache(fileName, language, out data))
 			return true;
 
-		lock (Locker)
-		{
-			if (TryToLoadTextFileFromCache(fileName, language, out data))
-				return true;
-
-			if (!LoadTextFileFromFileSystem(fileName, language, out data))
-				return false;
+		if (!LoadTextFileFromFileSystem(fileName, language, out data))
+			return false;
 
-			TextCache.Add(new KeyValuePair<string, string>(fileName, language), data);
+		TextCache.TryAdd(new KeyValuePair<string, string>(fileName, language), data);
 
-			return true;
-		}
+		return true;
 	}
 
 	private bool LoadXDocumentFromFileSystem(string fileName, string language, out XDocument? data)
@@ -251,17 +216,11 @@ private bool LoadXDocumentCached(string fileName, string language, out XDocument
 		if (TryToLoadXDocumentFromCache(fileName, language, out data))
 			return true;
 
-		lock (Locker)
-		{
-			if (TryToLoadXDocumentFromCache(fileName, language, out data))
-				return true;
-
-			if (!LoadXDocumentFromFileSystem(fileName, language, out data))
-				return false;
+		if (!LoadXDocumentFromFileSystem(fileName, language, out data))
+			return false;
 
-			XmlCache.Add(new KeyValuePair<string, string>(fileName, language), data);
+		XmlCache.TryAdd(new KeyValuePair<string, string>(fileName, language), data);
 
-			return true;
-		}
+		return true;
 	}
 }