From f33bc0304e0d0744286eab8ea9b0f45acec6fd73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Foidl?= <gue@korporal.at>
Date: Mon, 7 Apr 2025 10:56:55 +0200
Subject: [PATCH 1/3] Removed bound checks in SharedUrlHelper.IsLocalUrl and
 use JIT unrolling for checks

---
 src/Shared/ResultsHelpers/SharedUrlHelper.cs | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/Shared/ResultsHelpers/SharedUrlHelper.cs b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
index aa64d071bfef..1c971dc140fb 100644
--- a/src/Shared/ResultsHelpers/SharedUrlHelper.cs
+++ b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
@@ -37,40 +37,40 @@ internal static bool IsLocalUrl([NotNullWhen(true)] string? url)
             return false;
         }
 
+        var urlSpan = url.AsSpan();
+
         // Allows "/" or "/foo" but not "//" or "/\".
-        if (url[0] == '/')
+        if (urlSpan.StartsWith('/'))
         {
             // url is exactly "/"
-            if (url.Length == 1)
+            if (urlSpan.Length < 2)
             {
                 return true;
             }
 
             // url doesn't start with "//" or "/\"
-            if (url[1] != '/' && url[1] != '\\')
+            if (urlSpan[1] is not '/' and '\\')
             {
-                return !HasControlCharacter(url.AsSpan(1));
+                return !HasControlCharacter(urlSpan.Slice(1));
             }
 
             return false;
         }
 
         // Allows "~/" or "~/foo" but not "~//" or "~/\".
-        if (url[0] == '~' && url.Length > 1 && url[1] == '/')
+        if (urlSpan.StartsWith("~/"))
         {
             // url is exactly "~/"
-            if (url.Length == 2)
+            if (urlSpan.Length < 3)
             {
                 return true;
             }
 
             // url doesn't start with "~//" or "~/\"
-            if (url[2] != '/' && url[2] != '\\')
+            if (urlSpan[2] is not '/' and '\\')
             {
-                return !HasControlCharacter(url.AsSpan(2));
+                return !HasControlCharacter(urlSpan.Slice(2));
             }
-
-            return false;
         }
 
         return false;

From baa3cd9bf4c97ddc17b2ec03e3f71307714103cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Foidl?= <gue@korporal.at>
Date: Mon, 7 Apr 2025 11:16:02 +0200
Subject: [PATCH 2/3] Optimized the case '/'

---
 src/Shared/ResultsHelpers/SharedUrlHelper.cs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Shared/ResultsHelpers/SharedUrlHelper.cs b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
index 1c971dc140fb..a5df2728e726 100644
--- a/src/Shared/ResultsHelpers/SharedUrlHelper.cs
+++ b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
@@ -32,15 +32,15 @@ internal static class SharedUrlHelper
 
     internal static bool IsLocalUrl([NotNullWhen(true)] string? url)
     {
-        if (string.IsNullOrEmpty(url))
+        var urlSpan = url.AsSpan();
+
+        if (urlSpan.IsEmpty)
         {
             return false;
         }
 
-        var urlSpan = url.AsSpan();
-
         // Allows "/" or "/foo" but not "//" or "/\".
-        if (urlSpan.StartsWith('/'))
+        if (urlSpan[0] == '/')
         {
             // url is exactly "/"
             if (urlSpan.Length < 2)

From 75dd59ee8cacadec783669b9f3b5de8e883ef1f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=BCnther=20Foidl?= <gue@korporal.at>
Date: Mon, 7 Apr 2025 11:52:26 +0200
Subject: [PATCH 3/3] Force inline of the HasControlCharacter as it's an easy
 loop

---
 src/Shared/ResultsHelpers/SharedUrlHelper.cs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Shared/ResultsHelpers/SharedUrlHelper.cs b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
index a5df2728e726..4b40110fd303 100644
--- a/src/Shared/ResultsHelpers/SharedUrlHelper.cs
+++ b/src/Shared/ResultsHelpers/SharedUrlHelper.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
+using System.Runtime.CompilerServices;
 using Microsoft.AspNetCore.Http;
 
 namespace Microsoft.AspNetCore.Internal;
@@ -75,6 +76,7 @@ internal static bool IsLocalUrl([NotNullWhen(true)] string? url)
 
         return false;
 
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
         static bool HasControlCharacter(ReadOnlySpan<char> readOnlySpan)
         {
             // URLs may not contain ASCII control characters.