From 603ce66526f0e2d705e28baa344d3f34d78df74f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:26:04 +0000
Subject: [PATCH 1/3] Initial plan


From 39c3cab84f4c9d18f4ce9ac2b66fc806a5a91da4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:29:30 +0000
Subject: [PATCH 2/3] fix: validate reporting endpoint URL scheme (http/https)
 to fix .NET 10 Linux Uri.TryCreate behavior

On .NET 10 Linux, Uri.TryCreate("/reports", UriKind.Absolute, out _) returns true
because it interprets the path as file:///reports. The validator now additionally
checks that the parsed URI has an http or https scheme, ensuring relative paths
and non-web URIs are properly rejected.
---
 .../Infrastructure/NetSecureHeadersOptionsValidator.cs         | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
index 7342f6d..727267b 100644
--- a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
+++ b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
@@ -112,7 +112,8 @@ private static void ValidateReportingEndpoints(NetSecureHeadersOptions options,
             {
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must not be null, empty, or whitespace. Fix: provide an absolute HTTPS URL such as 'https://reports.example.com/csp'.");
             }
-            else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out _))
+            else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out var parsedUrl) ||
+                     (parsedUrl.Scheme != Uri.UriSchemeHttps && parsedUrl.Scheme != Uri.UriSchemeHttp))
             {
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must be absolute. Fix: use a full URL such as 'https://reports.example.com/csp'.");
             }

From f2a903d03b3adbe9ea23339d9376a799f22e0cd6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:31:32 +0000
Subject: [PATCH 3/3] fix: add explicit null guard on parsedUrl in
 ValidateReportingEndpoints

---
 .../Infrastructure/NetSecureHeadersOptionsValidator.cs           | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
index 727267b..32d24d1 100644
--- a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
+++ b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
@@ -113,6 +113,7 @@ private static void ValidateReportingEndpoints(NetSecureHeadersOptions options,
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must not be null, empty, or whitespace. Fix: provide an absolute HTTPS URL such as 'https://reports.example.com/csp'.");
             }
             else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out var parsedUrl) ||
+                     parsedUrl is null ||
                      (parsedUrl.Scheme != Uri.UriSchemeHttps && parsedUrl.Scheme != Uri.UriSchemeHttp))
             {
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must be absolute. Fix: use a full URL such as 'https://reports.example.com/csp'.");