#12133 Block file scheme in Web Request Helper
Web Request Helper now rejects file:// URLs before creating HTTP requests to prevent unauthorized local file access through crafted URLs.
- 1files
- 1AL files
- 1objects
Pull request · merged into main (BC30) on 2026-09-30 by darjoo · 1 file (+7 -0), 1 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Blocks the file URI scheme in GetResponseTextInternal before HttpWebRequest.Create is called
- Callers get a false return instead of an unhandled error
- No behavior change for http and https URLs
- Reuses the existing IsValidUri check, so invalid URIs now fail earlier
- Security fix that stops crafted URLs from reading files on the server
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 1299 “Web Request Helper”, Base Application: modified
Also merged into
- #12131 into
releases/29.xon 2026-09-30
Context
- Work items: AB#648417, AB#648437
- Labels: Team: Integrations
- Systems: integration
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).