---
id: change/bcapps/12133
type: change
title: "#12133 Block file scheme in Web Request Helper"
summary: Web Request Helper now rejects file:// URLs before creating HTTP requests to prevent unauthorized local file access through crafted URLs.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit web request helper
system: integration
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:03:02.331Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: df3ab2d79eb97aed4bef8db42748bc7fa3331a65
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/12133
    title: "microsoft/BCApps#12133: Block file scheme in Web Request Helper"
    date: "2026-09-30"
    commit: df3ab2d79eb97aed4bef8db42748bc7fa3331a65
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/codeunit/1299
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 12133
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/12133
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-30T18:31:38Z"
author: darjoo
author_type: User
community_contribution: false
labels:
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 1
  additions: 7
  deletions: 0
  al: 1
apps:
  - Base Application
objects_touched:
  - key: codeunit/1299
    page: codeunit/1299
    type: codeunit
    id: 1299
    name: Web Request Helper
    app: Base Application
    status: modified
objects_unjoined: []
obsoletions: []
backports:
  - number: 12131
    base: releases/29.x
    url: https://github.com/microsoft/BCApps/pull/12131
fixes_issues: []
work_items:
  - 648417
  - 648437
systems:
  - integration
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #12133 Block file scheme in Web Request Helper

> Web Request Helper now rejects file:// URLs before creating HTTP requests to prevent unauthorized local file access through crafted URLs.

[Pull request](https://github.com/microsoft/BCApps/pull/12133) · merged into `main` (BC30) on 2026-09-30 by darjoo · 1 file (+7 -0), 1 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Blocks the file URI scheme in GetResponseTextInternal before HttpWebRequest.Create is called
- Callers get a false return instead of an unhandled error
- No behavior change for http and https URLs
- Reuses the existing IsValidUri check, so invalid URIs now fail earlier
- Security fix that stops crafted URLs from reading files on the server
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 1299 "Web Request Helper"](../../objects/codeunit/1299.md), Base Application: modified

## Also merged into

- [#12131](https://github.com/microsoft/BCApps/pull/12131) into `releases/29.x` on 2026-09-30

## Context

- Work items: AB#648417, AB#648437
- Labels: Team: Integrations
- Systems: integration

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).