Repository: dotnet/runtime
File: src/libraries/System.Net.NameResolution/src/System/Net/Dns.cs (C#)

Code before:
            {
                return false;
            }

            // Strip trailing dot if present (DNS root notation)
            ReadOnlySpan<char> hostSpan = hostName.AsSpan();
            if (hostSpan.Length > 0 && hostSpan[hostSpan.Length - 1] == '.')
            {
                hostSpan = hostSpan.Slice(0, hostSpan.Length - 1);
            }

            // Matches "reservedName" exactly, or "*.reservedName" (subdomain)
            return hostSpan.EndsWith(reservedName, StringComparison.OrdinalIgnoreCase) &&
                   (hostSpan.Length == reservedName.Length ||
                    hostSpan[hostSpan.Length - reservedName.Length - 1] == '.');
        }

        /// <summary>
        /// Checks if the given host name is a subdomain of localhost (e.g., "foo.localhost").
        /// Plain "localhost" or "localhost." returns false.
        /// </summary>
        private static bool IsLocalhostSubdomain(string hostName)
        {
            // Strip trailing dot for length comparison
            int length = hostName.Length;
            if (length > 0 && hostName[length - 1] == '.')
            {
                length--;
            }

            // Must be longer than "localhost" (not just equal with trailing dot)
            return length > "localhost".Length && IsReservedName(hostName, "localhost");
        }

        /// <summary>
        /// Tries to handle RFC 6761 "invalid" domain names.
        /// Returns true if the host name is an invalid domain (exception will be set).
        /// </summary>
        private static bool TryHandleRfc6761InvalidDomain(string hostName, out SocketException? exception)
        {
            // RFC 6761 Section 6.4: "invalid" and "*.invalid" must always return NXDOMAIN.
            if (IsReservedName(hostName, "invalid"))
            {
                if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Returning NXDOMAIN for 'invalid' domain");
                exception = new SocketException((int)SocketError.HostNotFound);
                return true;
            }

            exception = null;
            return false;
        }

Review comment (suggestion):
```suggestion
            if (hostName.EndsWith('.'))
```

Code after:
        {
            // Reject malformed hostnames - let OS resolver handle them (and reject them)
            if (hostName.StartsWith('.') || hostName.Contains("..", StringComparison.Ordinal))
            {
                return false;
            }

            // Strip trailing dot if present (DNS root notation)
            ReadOnlySpan<char> hostSpan = hostName.AsSpan();
            if (hostSpan.EndsWith('.'))
            {
                hostSpan = hostSpan.Slice(0, hostSpan.Length - 1);
            }

            // Matches "reservedName" exactly, or "*.reservedName" (subdomain)
            return hostSpan.EndsWith(reservedName, StringComparison.OrdinalIgnoreCase) &&
                   (hostSpan.Length == reservedName.Length ||
                    hostSpan[hostSpan.Length - reservedName.Length - 1] == '.');
        }

        /// <summary>
        /// Checks if the given host name is a subdomain of localhost (e.g., "foo.localhost").
        /// Plain "localhost" or "localhost." returns false.
        /// </summary>
        private static bool IsLocalhostSubdomain(string hostName)
        {
            // Strip trailing dot for length comparison
            int length = hostName.Length;
            if (hostName.EndsWith('.'))
            {
                length--;
            }

            // Must be longer than "localhost" (not just equal with trailing dot)
            return length > Localhost.Length && IsReservedName(hostName, Localhost);
        }

        /// <summary>
        /// Tries to handle RFC 6761 "invalid" domain names.
        /// Returns true if the host name is an invalid domain (exception will be set).
        /// </summary>
        private static bool TryHandleRfc6761InvalidDomain(string hostName, out SocketException? exception)
        {
            // RFC 6761 Section 6.4: "invalid" and "*.invalid" must always return NXDOMAIN.
            if (IsReservedName(hostName, InvalidDomain))
            {
                if (NetEventSource.Log.IsEnabled()) NetEventSource.Info(hostName, "RFC 6761: Returning NXDOMAIN for 'invalid' domain");
                exception = new SocketException((int)SocketError.HostNotFound);
                return true;
            }