querystrings not be registered for actions

[markdav-is]

I have a search module witth an index and an addfilter action. There's a button on the index page that lets you call the AddFilter action. White testing, I can't get to the parameters being passed in the addfilter action alhtough they exist in the actual querystring.

   // index action
    private void AddFilter()
   {
       var retUrl = PageState.Page.Path;
       var url = EditUrl("AddFilter",$"?returnurl={retUrl}&search={_searchString}");

       NavigationManager.NavigateTo(url);
   }

 // addfilter action

    protected override async Task OnParametersSetAsync()
    {
        if (!ShouldRender()) return;
        var uq = PageState.Uri.Query;  // parameters exist
        var qs = PageState.QueryString; // two blank parameters
        var rq = PageState.Route.Query; // parameters exist
        var _returnUrl = PageState.ReturnUrl;  // blank
        IsLoaded = true;
    }

I'm using Oqtane 6.0.1 on this one and might upgrade to 6.1 to see if that's the problem. Any help would be appreciated.
 

[sbwalker]

@markdav-is when specifying a Url as a Querystring parameter you need to UrlEncode the value or else you will run into Url parsing issues

[markdav-is]

I added encoding and also upgraded to 6.1.0. no change in behavior.

    private void AddFilter()
    {
        // urlencode the return url

        var retUrl = WebUtility.UrlEncode(PageState.Page.Path);
        var url = EditUrl("AddFilter",$"?returnurl={retUrl}&search={_searchString}");

        NavigationManager.NavigateTo(url);
    }

links to relevant code chunks:

• index add button
• addfilter button

[markdav-is]

found it! returnurl must start with a backslash!

 if (querystring.ContainsKey("returnurl"))
 {
     returnurl = WebUtility.UrlDecode(querystring["returnurl"]);
     if (!returnurl.StartsWith("/"))
     {
         // urls which are not relative are vulnerable to open redirects or XSS
         returnurl = "";
         querystring["returnurl"] = "";
     }
 }

fromSiteRouter. might want to log that?

[sbwalker]

@markdav-is this is why it is generally recommended to use the URL helper methods rather than trying to hand-code URLs.