-
Notifications
You must be signed in to change notification settings - Fork 265
Description
During testing of empty filename scenarios, we discovered a bug in the Microsoft Graph .NET SDK's URL construction when using [ItemWithPath("")]with empty strings.
When calling [graphClient.Drives[driveId].Root.ItemWithPath("").Content.GetAsync()] the SDK generates malformed URLs that duplicate path segments:
This issue stems from the [ItemWithPath] extension method in DriveItemRequestBuilderExtensions.cs
builder.Path += $":{path}:"; // When path is "", this becomes "::"
Exected behavior:
https://graph.microsoft.com/v1.0/drives/{driveId}/root::/content
and the SDK should probably return an exception for null filenames
How to repro:
Create a GraphServiceClient instance
Call [graphClient.Drives[driveId].Root.ItemWithPath("").Content.GetAsync()])
Observe the generated HTTP request URL in network logs
SDK version: 5.94.0
Debug output:
HTTP REQUEST >>>>>>>>
------ JWT payload (relevant ID claims only) ------
"app_displayname": DAMS vNext SPE
"appid": 2b376c51-fcaf-4c86-823a-622ecc45c27e
"aud": https://graph.microsoft.com/
"idtyp": app
"iss": https://sts.windows.net/0f7c36b4-4e13-46ce-a1ea-7e6ecb8dd391/
"oid": 81c7703e-f477-4459-a491-235266b06df1
"sub": 81c7703e-f477-4459-a491-235266b06df1
"tid": 0f7c36b4-4e13-46ce-a1ea-7e6ecb8dd391
------ JWT payload (relevant ID claims only) ------
GET https://graph.microsoft.com/v1.0/drives/{driveId}/root:443/v1.0/drives/{driveId}/root:/content HTTP/2.0
Accept: application/octet-stream, application/json
Authorization: REDACTED
Cache-Control: no-store, no-cache
client-request-id: 6e8f0db8-bade-4886-b22f-e98b7f2bc06f
FeatureFlag: 00000003
SdkVersion: graph-dotnet-core/3.2.4 (featureUsage=00000003; hostOS=Microsoft Windows NT 10.0.22631.0; hostArch=X64; runtimeEnvironment=.NET 10.0.0-rc.2.25502.107;)
User-Agent: kiota-dotnet/1.17.1
[no content]
[2025-10-24T21:43:14.2060635+00:00]: Sending request... completed in 53ms [2025-10-24T21:43:14.2599208+00:00].
<<<<<<<< HTTP RESPONSE <<<<<<<<
HTTP/2.0 400 Bad Request
client-request-id: 6e8f0db8-bade-4886-b22f-e98b7f2bc06f
Content-Type: application/json
Date: Fri, 24 Oct 2025 21:43:13 GMT
request-id: c83d5fd8-1a6f-4a1c-b330-8e720631c89b
Strict-Transport-Security: max-age=31536000
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"East US","Slice":"E","Ring":"5","ScaleUnit":"000","RoleInstance":"BL6PEPF0002814A"}}
{
"error": {
"code": "BadRequest",
"message": "Resource not found for the segment \u0027root:443\u0027.",
"innerError": {
"date": "2025-10-24T21:43:14",
"request-id": "c83d5fd8-1a6f-4a1c-b330-8e720631c89b",
"client-request-id": "6e8f0db8-bade-4886-b22f-e98b7f2bc06f"
}
}
}