Repository: dotnet/runtime
File: src/libraries/System.Net.WebProxy/src/System/Net/WebProxy.cs (C#)

Code before:
                var bypassList = new string[_bypassList.Count];
                _bypassList.CopyTo(bypassList);
                return bypassList;
            }
            set
            {
                _bypassList = value != null ? new ChangeTrackingArrayList(value) : null;
                UpdateRegexList(); // prompt creation of the Regex instances so that any exceptions are propagated
            }
        }

        /// <summary>
        /// Gets or sets an <see cref="ArrayList"/> of addresses that do not use the proxy server.
        /// </summary>
        /// <value>
        /// An <see cref="ArrayList"/> that contains a list of regular expressions that represents URIs that do not use the proxy server when accessed.
        /// </value>
        public ArrayList BypassArrayList => _bypassList ??= new ChangeTrackingArrayList();

        /// <summary>
        /// Gets or sets the credentials to submit to the proxy server for authentication.
        /// </summary>
        /// <value>
        /// An <see cref="ICredentials"/> instance that contains the credentials to submit to the proxy server for authentication.
        /// </value>
        /// <exception cref="InvalidOperationException">You attempted to set this property when the <see cref="UseDefaultCredentials"/> property was set to <see langword="true"/>.</exception>
        public ICredentials? Credentials { get; set; }

        /// <summary>
        /// Gets or sets a value that controls whether the <see cref="CredentialCache.DefaultCredentials"/> are sent with requests.
        /// </summary>
        /// <value>
        /// <see langword="true"/> if the default credentials are used; otherwise, <see langword="false"/>. The default value is <see langword="false"/>.
        /// </value>
        /// <exception cref="InvalidOperationException">You attempted to set this property when the <see cref="Credentials"/> property contains credentials other than the default credentials.</exception>
        public bool UseDefaultCredentials
        {
            get => Credentials == CredentialCache.DefaultCredentials;
            set => Credentials = value ? CredentialCache.DefaultCredentials : null;
        }

        /// <summary>
        /// Returns the URI of a proxy.
        /// </summary>
        /// <param name="destination">The <see cref="Uri"/> instance of the requested Internet resource.</param>
        /// <returns>
        /// The <see cref="Uri"/> instance of the Internet resource, if the resource is on the bypass list; otherwise, the <see cref="Uri"/> instance of the proxy.
        /// </returns>
        /// <exception cref="ArgumentNullException">The <paramref name="destination"/> parameter is <see langword="null"/>.</exception>
        public Uri? GetProxy(Uri destination)
        {

Review comment (security):
```suggestion
        /// <exception cref="InvalidOperationException">.NET Framework only: <see cref="UseDefaultCredentials"/> is set to <see langword="true"/>.</exception>
```

Code after:
            return IsBypassed(destination) ? destination : Address;
        }

        private static Uri? CreateProxyUri(string? address, int? port = null)
        {
            if (address is null)
            {
                return null;
            }

            if (!address.Contains("://", StringComparison.Ordinal))
            {
                address = "http://" + address;
            }

            var proxyUri = new Uri(address);

            if (port.HasValue && proxyUri.IsAbsoluteUri)
            {
                proxyUri = new UriBuilder(proxyUri) { Port = port.Value }.Uri;
            }

            return proxyUri;
        }

        private void UpdateRegexList()
        {
            if (_bypassList is ChangeTrackingArrayList bypassList)
            {
                Regex[]? regexBypassList = null;
                if (bypassList.Count > 0)
                {
                    regexBypassList = new Regex[bypassList.Count];
                    for (int i = 0; i < regexBypassList.Length; i++)
                    {
                        regexBypassList[i] = new Regex((string)bypassList[i]!, RegexOptions.IgnoreCase | RegexOptions.CultureInvariant);
                    }
                }

                _regexBypassList = regexBypassList;
                bypassList.IsChanged = false;
            }
            else
            {
                _regexBypassList = null;
            }
        }

        private bool IsMatchInBypassList(Uri input)
        {
            // Update our list of Regex instances if the ArrayList has changed.