A better way to validate URL in C# than try-catch?

Question

I'm building an application to retrieve an image from internet. Even though it works fine, it is slow (on wrong given URL) when using try-catch statements in the application.

(1) Is this the best way to verify URL and handle wrong input - or should I use Regex (or some other method) instead?

(2) Why does the application try to find images locally if I don't specify http:// in the textBox?

private void btnGetImage_Click(object sender, EventArgs e)
{
    String url = tbxImageURL.Text;
    byte[] imageData = new byte[1];

    using (WebClient client = new WebClient())
    {
        try
        {
            imageData = client.DownloadData(url);
            using (MemoryStream ms = new MemoryStream(imageData))
            {
                try
                {
                    Image image = Image.FromStream(ms);
                    pbxUrlImage.Image = image;
                }
                catch (ArgumentException)
                {
                    MessageBox.Show("Specified image URL had no match", 
                        "Image Not Found", MessageBoxButtons.OK, 
                        MessageBoxIcon.Error);
                }
            }
        }
        catch (ArgumentException)
        {
            MessageBox.Show("Image URL can not be an empty string", 
                "Empty Field", MessageBoxButtons.OK, 
                MessageBoxIcon.Information);
        }
        catch (WebException)
        {
            MessageBox.Show("Image URL is invalid.\nStart with http:// " +
                "and end with\na proper image extension", "Not a valid URL",
                MessageBoxButtons.OK, MessageBoxIcon.Information);
        }
    } // end of outer using statement
} // end of btnGetImage_Click

EDIT: I tried the suggested solution by Panagiotis Kanavos (thank you for your effort!), but it only gets caught in the if-else statement if the user enters http:// and nothing more. Changing to UriKind.Absolute catches empty strings as well! Getting closer :) The code as of now:

private void btnGetImage_Click(object sender, EventArgs e)
{
    String url = tbxImageURL.Text;
    byte[] imageData = new byte[1];
    Uri myUri;

    // changed to UriKind.Absolute to catch empty string
    if (Uri.TryCreate(url, UriKind.Absolute, out myUri))
    {
        using (WebClient client = new WebClient())
        {
            try
            {
                imageData = client.DownloadData(myUri);
                using (MemoryStream ms = new MemoryStream(imageData))
                {
                    imageData = client.DownloadData(myUri);
                    Image image = Image.FromStream(ms);
                    pbxUrlImage.Image = image;
                }
            }
            catch (ArgumentException)
            {
                MessageBox.Show("Specified image URL had no match",
                    "Image Not Found", MessageBoxButtons.OK, 
                    MessageBoxIcon.Error);
            }
            catch (WebException)
            {
                MessageBox.Show("Image URL is invalid.\nStart with http:// " +
                    "and end with\na proper image extension", 
                    "Not a valid URL",
                    MessageBoxButtons.OK, MessageBoxIcon.Information);
            }
        }
    }
    else
    {
        MessageBox.Show("The Image Uri is invalid.\nStart with http:// " +
            "and end with\na proper image extension", "Uri was not created",
            MessageBoxButtons.OK, MessageBoxIcon.Information);
    }

I must be doing something wrong here. :(

How do you know that `ArgumentException` or `WebException` mean a problem with the URL? — John Saunders, Nov 01 '11 at 21:31
It was the Exceptions I got when debugging. But I agree - there could be a lot more types of exception downloading from Internet. — Benny Skogberg, Nov 02 '11 at 19:24

score 113 · Accepted Answer · edited May 23 '17 at 12:00

113

Use Uri.TryCreate to create a new Uri object only if your url string is a valid URL. If the string is not a valid URL, TryCreate returns false.

string myString = "http://someUrl";
Uri myUri;
if (Uri.TryCreate(myString, UriKind.RelativeOrAbsolute, out myUri))
{
    //use the uri here
}

UPDATE

TryCreate or the Uri constructor will happily accept strings that may appear invalid, eg "Host: www.stackoverflow.com","Host:%20www.stackoverflow.com" or "chrome:about". In fact, these are perfectly valid URIs that specify a custom scheme instead of "http".

The documentation of the Uri.Scheme property provides more examples like "gopher:" (anyone remember this?), "news", "mailto", "uuid".

An application can register itself as a custom protocol handler as described in MSDN or other SO questions, eg How do I register a custom URL protocol in Windows?

TryCreate doesn't provide a way to restrict itself to specific schemes. The code needs to check the Uri.Scheme property to ensure it contains an acceptable value

UPDATE 2

Passing a weird string like "></script><script>alert(9)</script> will return true and construct a relative Uri object. Calling Uri.IsWellFormedOriginalString will return false though. So you probably need to call IsWellFormedOriginalString if you want to ensure that relative Uris are well formed.

On the other hand, calling TryCreate with UriKind.Absolute will return false in this case.

Interestingly, Uri.IsWellFormedUriString calls TryCreate internally and then returns the value of IsWellFormedOriginalString if a relative Uri was created.

edited May 23 '17 at 12:00

Community

1
1

answered Jul 12 '10 at 13:31

Panagiotis Kanavos

120,703
13
188
236

This fails if pass in a header string such as "Host: www.stackoverflow.com". By fails I mean, fails to detect it as an invalid URL – Martin Dec 19 '12 at 19:07
1

This is no failure. "Host: www.stackoverflow.com" or the equivalent "Host:%20www.stackoverflow.com" are valid URIs whose scheme is "host", just as "chrome:about" is a valid URI. This is how custom URL protocols are specified. There are many QAs on how to use custom protocols, eg http://stackoverflow.com/questions/80650/how-do-i-register-a-custom-url-protocol-in-windows – Panagiotis Kanavos Dec 20 '12 at 09:59
if the url ="\">",the result is true? – xiaoyifang Nov 15 '13 at 08:14
In that case the result is `true` but the generated *relative* uri will return `false` when you call `myUri.IsWellFormedOriginalString()` – Panagiotis Kanavos Nov 15 '13 at 08:59
`TryCreate` attempts to create a valid URI from invalid input. It will escape illegal characters and do other trickery (as shown in your example: the input is a false URI, the output is valid) . I.e. ":/" and "##foo" are invalid, but accepted by this method. Conversely, `IsWellFormedOriginalString` checks validity for it being an _absolute_ URI and would correctly return false here. Valid relative URIs will return false, try "ç.html". Make them absolute, and they validate correctly. As it stands, there's no way to test for RFC valid relative URIs, unless you first make them absolute. – Abel Oct 24 '19 at 03:13

score 55 · Answer 2 · answered Nov 01 '11 at 21:26

55

A shortcut would be to use Uri.IsWellFormedUriString:

if (Uri.IsWellFormedUriString(myURL, UriKind.RelativeOrAbsolute))
...

answered Nov 01 '11 at 21:26

Todd Menier

37,557
17
150
173

That's better if you just want to check the url. TryCreate will also create a Uri to use in the same step. – Panagiotis Kanavos Jun 12 '12 at 06:26
6

This is the best answer to the question that was actually asked. Well done. – Chris Rogers Dec 11 '12 at 23:15
Actually, IsWellFormedUriString actually calls TryCreate to check if the url is valid but then checks whether the returned uri returns true from uri.IsWellFormedOriginalString(). – Panagiotis Kanavos Nov 15 '13 at 08:57
This only works for absolute URIs, for relative URIs, this method returns false negatives more often than not. But this is consistent with the docs, which explain it works on absolute URIs only. – Abel Oct 24 '19 at 17:50

score 5 · Answer 3 · answered Dec 19 '12 at 19:10

Some examples when using Uri to test a valid URL fails

Uri myUri = null;
if (Uri.TryCreate("Host: www.stackoverflow.com", UriKind.Absolute, out myUri))
{
}

  myUri = null;
if (Uri.TryCreate("Accept: application/json, text/javascript, */*; q=0.01", UriKind.Absolute, out myUri))
{
}

  myUri = null;
if (Uri.TryCreate("User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0", UriKind.Absolute, out myUri))
{
}

  myUri = null;
if (Uri.TryCreate("DNT: 1", UriKind.Absolute, out myUri))
{
}

I Was surprised to have all this nonsense appear in my listview after validating with the above. But it all passes the validation test.

Now I add the following after the above validation

url = url.ToLower();
if (url.StartsWith("http://") || url.StartsWith("https://")) return true;

Except that a valid uri can start with any scheme, like ftp or file, or even be a URN. You wouldn't catch those. Besides, MS doesn't claim `TryCreate` requires valid INPUT, instead it does it best to take nonsense input and still make something useful. Use `IsWellFormedOriginalString` for RFC level validation. Though it only works with absolute uris. — Abel, Oct 24 '19 at 03:00

score 4 · Answer 4 · edited Dec 23 '11 at 10:14

4

Hi you validate https http,ftp,sftp,ftps,any thing starting with www.

string regular = @"^(ht|f|sf)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+&amp;%\$#_]*)?$";
string regular123 = @"^(www.)[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+&amp;%\$#_]*)?$";

string myString = textBox1.Text.Trim();
if (Regex.IsMatch(myString, regular))
{
    MessageBox.Show("It is valide url  " + myString);
}
else if (Regex.IsMatch(myString, regular123))
{
    MessageBox.Show("Valide url with www. " + myString);
}
else 
{
    MessageBox.Show("InValide URL  " + myString);
}

edited Dec 23 '11 at 10:14

stema

90,351
20
107
135

answered Dec 23 '11 at 10:04

Naren

69
1

This should not be used in real world code, most invalid URIs will pass, and most valid URIs will fail (like "stackoverflow.com", "mailto:x", "urn:test" and any relative URI). – Abel Oct 24 '19 at 03:20

score 3 · Answer 5 · edited May 23 '17 at 12:33

you can use the function Uri.TryCreate As Panagiotis Kanavos suggested if you like to test and create a url or you can use Uri.IsWellFormedUriString function as suggested by Todd Menier if you just wanted to test the validity of Url. this can by handy if you are just validating user input for now and need to create url some time later in life time of your application.

**But my post is for the People, like myself :( , still hitting their heads against .net 1.1 **

both above methods were introduced in .net 2.0 so you guys still have to use try catch method, which, in my opinion, is still far better than using regular expression.

private bool IsValidHTTPURL(string url)
{
    bool result = false;

    try
    {
        Uri uri = new Uri(url);

        result = (uri.Scheme == "http" || uri.Scheme == "https");
    }
    catch (Exception ex) 
    { 
        log.Error("Exception while validating url", ex); 
    }

    return result;
}

score 3 · Answer 6 · answered Jan 01 '15 at 10:25

3

Use it.....

string myString = http//:google.com;
Uri myUri;
Uri.TryCreate(myString, UriKind.RelativeOrAbsolute, out myUri);
 if (myUri.IsAbsoluteUri == false)
 {
  MessageBox.Show("Please Input Valid Feed Url");
 }

answered Jan 01 '15 at 10:25

Shivam Srivastava

4,496
2
23
24

@ShivamShrivastava. Great! If i have let's say 10 records, and it contains working as well as non-working url, how can I print only the non-working urls in gridview or datatable? – Rohan Rao Oct 19 '19 at 11:46
This only tests if valid URL is a valid relative URL, and will still pass many invalid inputs too. – Abel Oct 24 '19 at 03:22

score 3 · Answer 7 · answered Dec 01 '11 at 10:05

Or this source code good image valid optimization:

 public static string ValidateImage(string absoluteUrl,string defaultUrl)
        { 
           Uri myUri=null; 
           if (Uri.TryCreate(absoluteUrl, UriKind.Absolute, out myUri))
            {
                using (WebClient client = new WebClient())
                {
                    try
                    {
                        using (Stream stream = client.OpenRead(myUri))
                        {
                            Image image = Image.FromStream(stream);
                            return (image != null) ? absoluteUrl : defaultUrl;
                        }
                    }
                    catch (ArgumentException)
                    {
                        return defaultUrl;
                    }
                    catch (WebException)
                    {
                        return defaultUrl;
                    }
                }
            }
            else
            {
                return defaultUrl;
            }
        }

Sou and demo asp.net mvc source image created:

<img src="@ValidateImage("http://example.com/demo.jpg","nophoto.png")"/>

score 2 · Answer 8 · answered Jun 07 '15 at 16:06

I wanted to check if the url also contains a domain extension, it needs to be a valid website url.

This is what i came up with:

 public static bool IsValidUrl(string url)
        {
            if (string.IsNullOrEmpty(url)) { return false;}

            if (!url.StartsWith("http://"))
            {
                url = "http://" + url;    
            }

            Uri outWebsite;

            return Uri.TryCreate(url, UriKind.Absolute, out outWebsite) && outWebsite.Host.Replace("www.", "").Split('.').Count() > 1 && outWebsite.HostNameType == UriHostNameType.Dns && outWebsite.Host.Length > outWebsite.Host.LastIndexOf(".") + 1 && 255 >= url.Length;
        }

I've tested the code with linqpad:

    void Main()
{
        // Errors
        IsValidUrl("www.google/cookie.png").Dump();
        IsValidUrl("1234").Dump();
        IsValidUrl("abcdef").Dump();
        IsValidUrl("abcdef/test.png").Dump();
        IsValidUrl("www.org").Dump();
        IsValidUrl("google").Dump();
        IsValidUrl("google.").Dump();
        IsValidUrl("google/test").Dump();
        IsValidUrl("User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0").Dump();
        IsValidUrl("</script><script>alert(9)</script>").Dump();
        IsValidUrl("Accept: application/json, text/javascript, */*; q=0.01").Dump();
        IsValidUrl("DNT: 1").Dump();

        Environment.NewLine.Dump();

        // Success
        IsValidUrl("google.nl").Dump();
        IsValidUrl("www.google.nl").Dump();
        IsValidUrl("http://google.nl").Dump();
        IsValidUrl("http://www.google.nl").Dump();
}

Results:

False False False False False False False False False False False False

True True True True

score 2 · Answer 9 · edited Dec 22 '11 at 13:45

2

My solution:

string regular = @"^(ht|f|sf)tp(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\'\/\\\+&amp;%\$#_]*)?$";
string myString = textBox1.Text.Trim();
if (Regex.IsMatch(myString, regular))
{
    MessageBox.Show("it is valide url  " + myString);
}
else
{
    MessageBox.Show("InValide url  " + myString);
}

edited Dec 22 '11 at 13:45

eeerahul

1,629
4
27
38

answered Dec 22 '11 at 12:38

Naren

69
1

score 1 · Answer 10 · edited Jun 20 '20 at 09:12

I ran into a very similar case so I wrote a static class which can be easily used along with xUnit tests to verify the logic passed several cases.

Usage (returns ValidationModel):

var message = UrlValidator.Validate(input).ValidationMessage;

or

var result = UrlValidator.Validate(input).IsValid;

ValidationModel.cs

    public class ValidationModel
    {
        public const string InvalidScheme = "Invalid URI scheme.";
        public const string EmptyInputValue = "Empty input value.";
        public const string InvalidUriFormat = "Invalid URI format.";
        public const string PassedValidation = "Passed validation";
        public const string HttpScheme = "http://";
        public const string HttpsScheme = "https://";

        public bool IsValid { get; set; }
        public string ValidationMessage { get; set; }
        
    }

UrlValidator.cs

    public static class UrlValidator
    {
        public static ValidationModel Validate(string input)
        {
            var validation = new ValidationModel();

            if (input == string.Empty)
            {
                validation.IsValid = false;
                validation.ValidationMessage = ValidationModel.EmptyInputValue;
                return validation;
            }

            try
            {
                var uri = new Uri(input);
                var leftPart = uri.GetLeftPart(UriPartial.Scheme);

                if (leftPart.Equals(ValidationModel.HttpScheme) || leftPart.Equals(ValidationModel.HttpsScheme))
                {
                    validation.IsValid = true;
                    validation.ValidationMessage = ValidationModel.PassedValidation;
                    return validation;
                }
                
                validation.IsValid = false;
                validation.ValidationMessage = ValidationModel.InvalidScheme;
            }
            catch (UriFormatException)
            {
                validation.IsValid = false;
                validation.ValidationMessage = ValidationModel.InvalidUriFormat;
            }
            
            return validation;
        }
    }

UrlValidatorTests.cs

    public class UrlValidatorTests
    {
        [Theory]
        [InlineData("http://intel.com", true, ValidationModel.PassedValidation)]
        [InlineData("https://intel.com", true, ValidationModel.PassedValidation)]
        [InlineData("https://intel.com/index.html", true, ValidationModel.PassedValidation)]
        [InlineData("", false, ValidationModel.EmptyInputValue)]
        [InlineData("http://", false, ValidationModel.InvalidUriFormat)]
        [InlineData("//intel.com", false, ValidationModel.InvalidScheme)]
        [InlineData("://intel.com", false, ValidationModel.InvalidUriFormat)]
        [InlineData("f://intel.com", false, ValidationModel.InvalidScheme)]
        [InlineData("htttp://intel.com", false, ValidationModel.InvalidScheme)]
        [InlineData("intel.com", false, ValidationModel.InvalidUriFormat)]
        [InlineData("ftp://intel.com", false, ValidationModel.InvalidScheme)]
        [InlineData("http:intel.com", false, ValidationModel.InvalidUriFormat)]
        public void Validate_Input_ExpectedResult(string input, bool expectedResult, string expectedInvalidMessage)
        {
            //Act
            var result = UrlValidator.Validate(input);

            //Assert
            Assert.Equal(expectedResult, result.IsValid);
            Assert.Equal(expectedInvalidMessage, result.ValidationMessage);
        }
    }

A better way to validate URL in C# than try-catch?

10 Answers10

ValidationModel.cs

UrlValidator.cs

UrlValidatorTests.cs

TEST RESULTS:

Linked