[edit] release v5.5.0 with security fixes, streaming static files, and binding improvements

- HTML-encode exception text in Http500ErrorPageBuilder to close XSS vector
- Normalize multiple leading slashes in request path to prevent path traversal
- Filter empty/whitespace roles in AuthorizeAttribute to prevent auth bypass
- Use StartsWith for Content-Type check in JsonModelBinder
- Add CopyToAsync to StaticFile; NewFileHandler now streams without buffering
- InMemoryFilesCacheHandler: use TryAdd to avoid concurrent-write race
- Preserve original exception when OnException handler itself throws
- Add CHANGELOG entries and bump version to 5.5.0

Author: i4004

src/Simplify.Web.Tests/Responses/FileTests.cs

@@ -102,6 +102,10 @@ public async Task Process_Stream_StreamSentAndDisposed()
 		Assert.That(_headerDictionary["Content-Disposition"], Is.EqualTo("inline"));
 
 		_responseWriter.Verify(x => x.WriteAsync(It.IsAny<HttpResponse>(), It.Is<Stream>(s => s == stream.Object)));
-		stream.Verify(x => x.Close());
+#if NETFRAMEWORK
+		stream.Verify(x => x.Dispose());
+#else
+		stream.Verify(x => x.DisposeAsync());
+#endif
 	}
 }

src/Simplify.Web.Tests/StaticFiles/Handlers/NewFileHandlerTests.cs

@@ -1,10 +1,10 @@
 using System;
+using System.IO;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Http;
 using Moq;
 using NUnit.Framework;
 using Simplify.System;
-using Simplify.Web.Http.ResponseWriting;
 using Simplify.Web.StaticFiles.Context;
 using Simplify.Web.StaticFiles.Handlers;
 using Simplify.Web.StaticFiles.IO;
@@ -17,15 +17,13 @@ public class NewFileHandlerTests
 {
 	private NewFileHandler _handler = null!;
 
-	private Mock<IResponseWriter> _responseWriter = null!;
 	private Mock<IStaticFile> _staticFile = null!;
 
 	[SetUp]
 	public void Initialize()
 	{
-		_responseWriter = new Mock<IResponseWriter>();
 		_staticFile = new Mock<IStaticFile>();
-		_handler = new NewFileHandler(_responseWriter.Object, _staticFile.Object);
+		_handler = new NewFileHandler(_staticFile.Object);
 	}
 
 	[Test]
@@ -45,7 +43,6 @@ public void CanHandle_CanBeCached_False()
 	public void CanHandle_CantBeCached_True()
 	{
 		// Arrange
-
 		var context = Mock.Of<IStaticFileProcessingContext>(x => !x.CanBeCached);
 
 		// Act
@@ -56,23 +53,27 @@ public void CanHandle_CantBeCached_True()
 	}
 
 	[Test]
-	public async Task ExecuteAsync_NewFile_FileSendToClientAndRespectiveResponsePropertiesAreSet()
+	public async Task ExecuteAsync_NewFile_FileStreamedToResponseBody()
 	{
 		// Arrange
 
 		var filePath = "Foo.txt";
 		var lastModificationTime = new DateTime(2013, 4, 5, 0, 0, 0, DateTimeKind.Utc);
-		var data = new byte[1] { 255 };
 
 		var context = Mock.Of<IStaticFileProcessingContext>(x =>
 			x.RelativeFilePath == filePath &&
 			x.LastModificationTime == lastModificationTime);
 
 		TimeProvider.Current = Mock.Of<ITimeProvider>(x => x.Now == new DateTime(2013, 1, 1, 0, 0, 0, DateTimeKind.Utc));
 
-		_staticFile.Setup(x => x.GetDataAsync(It.Is<string>(s => s == filePath))).Returns(Task.FromResult(data));
+		var bodyStream = new MemoryStream();
+		var response = Mock.Of<HttpResponse>(x =>
+			x.Headers == new HeaderDictionary() &&
+			x.Body == bodyStream);
 
-		var response = Mock.Of<HttpResponse>(x => x.Headers == new HeaderDictionary());
+		_staticFile.Setup(x => x.CopyToAsync(It.Is<Stream>(s => s == bodyStream), It.Is<string>(s => s == filePath)))
+			.Returns(Task.CompletedTask)
+			.Verifiable();
 
 		// Act
 		await _handler.ExecuteAsync(context, response);
@@ -83,6 +84,6 @@ public async Task ExecuteAsync_NewFile_FileSendToClientAndRespectiveResponseProp
 		Assert.That(response.Headers["Last-Modified"], Is.EqualTo(lastModificationTime.ToString("r")));
 		Assert.That(response.Headers["Expires"], Is.EqualTo(new DateTimeOffset(new DateTime(2014, 1, 1, 0, 0, 0, DateTimeKind.Utc)).ToString("R")));
 
-		_responseWriter.Verify(x => x.WriteAsync(It.Is<HttpResponse>(r => r == response), It.Is<byte[]>(b => b == data)));
+		_staticFile.Verify();
 	}
 }

src/Simplify.Web/Attributes/AuthorizeAttribute.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using Simplify.Web.System;
 
 namespace Simplify.Web.Attributes;
@@ -16,15 +17,16 @@ public class AuthorizeAttribute : Attribute
 	/// </summary>
 	/// <param name="requiredUserRoles">Required user roles.</param>
 	public AuthorizeAttribute(string? requiredUserRoles = null) =>
-		RequiredUserRoles = requiredUserRoles != null
-			? requiredUserRoles.ParseCommaSeparatedList()
+		RequiredUserRoles = !string.IsNullOrEmpty(requiredUserRoles)
+			? requiredUserRoles!.ParseCommaSeparatedList()
 			: [];
 
 	/// <summary>
 	/// Initializes a new instance of the <see cref="AuthorizeAttribute" /> class.
 	/// </summary>
 	/// <param name="requiredUserRoles">The required user roles.</param>
-	public AuthorizeAttribute(params string[] requiredUserRoles) => RequiredUserRoles = requiredUserRoles;
+	public AuthorizeAttribute(params string[] requiredUserRoles) =>
+		RequiredUserRoles = requiredUserRoles.Where(r => !string.IsNullOrEmpty(r));
 
 	/// <summary>
 	/// Gets the required user roles.

src/Simplify.Web/Bootstrapper/Setup/BaseBootstrapperStaticFiles.cs

@@ -74,7 +74,7 @@ public virtual void RegisterStaticFileRequestHandlingPipelineHandlers()
 			if (r.Resolve<ISimplifyWebSettings>().StaticFilesMemoryCache)
 				handlers.Add(new InMemoryFilesCacheHandler(r.Resolve<IResponseWriter>(), r.Resolve<IStaticFile>()));
 			else
-				handlers.Add(new NewFileHandler(r.Resolve<IResponseWriter>(), r.Resolve<IStaticFile>()));
+				handlers.Add(new NewFileHandler(r.Resolve<IStaticFile>()));
 
 			return (IReadOnlyList<IStaticFileRequestHandler>)handlers;
 		}, LifetimeType.Singleton);

src/Simplify.Web/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [5.5.0] - 2026-07-06
+
+### Added
+
+- MaxRequestBodySize setting (default: 100 MB) to cap request body reads during
+  model binding, preventing memory-exhaustion DoS. Configurable via
+  `SimplifyWebSettings:MaxRequestBodySize` in appsettings.json.
+
+### Security
+
+- Http500ErrorPageBuilder: HTML-encode exception text before rendering it in the
+  error page, closing an XSS vector when HideExceptionDetails is false.
+
+### Fixed
+
+- StringToSpecifiedObjectParser: wrap Enum.Parse in a try/catch with a clear
+  ModelBindingException message and pass ignoreCase: true so route parameter casing
+  does not cause spurious binding failures.
+- File response: use `await using` for the data stream so it is disposed correctly
+  under all target frameworks.
+- SimplifyWebRequestMiddleware: preserve the original exception when the OnException
+  handler itself throws, instead of replacing it with the handler's exception.
+- RequestPathExtensions: normalize multiple leading slashes in the request path
+  to prevent path-traversal probes via "//" prefixed URLs.
+- AuthorizeAttribute: treat empty or whitespace-only role strings as absent so that
+  `[Authorize("")]` does not bypass authorization entirely.
+- JsonModelBinder: use StartsWith (ordinal, ignore-case) instead of Contains for the
+  Content-Type check to avoid matching unrelated media types.
+
+### Changed
+
+- StaticFile: add CopyToAsync(Stream, string) that streams file content directly to
+  the target stream without loading it into memory first. NewFileHandler now uses
+  this streaming path, reducing memory pressure for large static files.
+- InMemoryFilesCacheHandler: use TryAdd instead of the indexer to avoid a race
+  condition when multiple threads cache the same file concurrently.
+
 ## [5.4.0] - 2026-07-04
 
 ### Added

src/Simplify.Web/Diagnostics/Templates/Http500ErrorPageBuilder.cs

@@ -1,4 +1,5 @@
-using System.Reflection;
+using System.Net;
+using System.Reflection;
 using Simplify.System;
 using Simplify.Templates;
 
@@ -27,7 +28,7 @@ private static ITemplate SetExceptionInfo(this ITemplate tpl, string? exceptionT
 			? ""
 			: TemplateBuilder.FromCurrentAssembly("Diagnostics.Templates.Http500ErrorPageExceptionInfo.html")
 				.Build()
-				.Set("ExceptionText", exceptionText)
+				.Set("ExceptionText", WebUtility.HtmlEncode(exceptionText))
 				.Get());
 
 	private static ITemplate SetStyle(this ITemplate tpl, bool darkStyle) =>

src/Simplify.Web/Http/RequestPath/RequestPathExtensions.cs

@@ -18,10 +18,22 @@ public static string GetRelativeFilePath(this HttpRequest request)
 		if (string.IsNullOrEmpty(request.Path.Value))
 			return "";
 
+		var path = request.Path.Value;
+
+		// Normalize multiple leading slashes (e.g. "//etc/passwd" -> "/etc/passwd")
+		// to prevent path traversal attempts through URL encoding tricks.
+		var startIndex = 0;
+
+		while (startIndex < path.Length && path[startIndex] == '/')
+			startIndex++;
+
+		if (startIndex >= path.Length)
+			return "";
+
 #if NETSTANDARD2_0
-		return request.Path.Value.Substring(1);
+		return path.Substring(startIndex);
 #else
-		return request.Path.Value[1..];
+		return path[startIndex..];
 #endif
 	}
 

src/Simplify.Web/Middleware/SimplifyWebRequestMiddleware.cs

@@ -47,6 +47,8 @@ public static async Task InvokeAsync(HttpContext context)
 	{
 		using var scope = BootstrapperFactory.ContainerProvider.BeginLifetimeScope();
 
+		Exception? caughtException = null;
+
 		try
 		{
 			await scope.StartMeasurements()
@@ -56,13 +58,15 @@ await scope.StartMeasurements()
 		}
 		catch (Exception e)
 		{
+			caughtException = e;
+
 			try
 			{
 				ProcessOnException(e);
 			}
-			catch (Exception exception)
+			catch
 			{
-				e = exception;
+				// OnException handler failure is non-fatal; keep the original exception.
 			}
 
 			// Once the response has started the headers are already sent — we can neither set the
@@ -74,7 +78,7 @@ await scope.StartMeasurements()
 
 			context.Response.StatusCode = 500;
 
-			await context.WriteErrorResponseAsync(scope, e);
+			await context.WriteErrorResponseAsync(scope, caughtException);
 		}
 	}
 

src/Simplify.Web/Model/Binding/Binders/JsonModelBinder.cs

@@ -34,7 +34,7 @@ public class JsonModelBinder : IModelBinder
 	/// <exception cref="InvalidOperationException">Deserialized model is null.</exception>
 	public async Task BindAsync<T>(ModelBinderEventArgs<T> args)
 	{
-		if (args.Context.Request.ContentType == null || !args.Context.Request.ContentType.Contains("application/json"))
+		if (args.Context.Request.ContentType == null || !args.Context.Request.ContentType.StartsWith("application/json", StringComparison.OrdinalIgnoreCase))
 			return;
 
 		await args.Context.ReadRequestBodyAsync();

src/Simplify.Web/Model/Binding/Parsers/StringToSpecifiedObjectParser.cs

@@ -266,7 +266,17 @@ public static DateTime ParseDateTime(string value, string? format = null)
 	/// </summary>
 	/// <param name="value">The value.</param>
 	/// <param name="enumType">Type of the enum.</param>
-	public static object ParseEnum(string value, Type enumType) => Enum.Parse(enumType, value);
+	public static object ParseEnum(string value, Type enumType)
+	{
+		try
+		{
+			return Enum.Parse(enumType, value, ignoreCase: true);
+		}
+		catch (ArgumentException ex)
+		{
+			throw new ModelBindingException($"String to enum parsing failed, value: '{value}', type: '{enumType.Name}'", ex);
+		}
+	}
 
 	/// <summary>
 	/// Determines whether specified type is valid for parsing.