ApiVersionMatcherPolicy doesn't check candidate validity.

[jtkech]

In OrchardCore we don't use AddApiVersioning() by default but someone did and experienced a NRE in ApiVersionMatcherPolicy. We already had the exact same issue with PageLoaderMatcherPolicy that we use by default, see here the related issue we opened and whose fix has been merged.

Here the description of this related issue where you can replace PageLoaderMatcherPolicy with ApiVersionMatcherPolicy.

If a DynamicRouteValueTransformer, mapped to a given pattern, doesn't always return some route values related to a valid endpoint, when this is the case for a given path which also matches a razor page, PageLoaderMatcherPolicy fails line 71 because of a null endpoint.

The issue was that the policy was not checking the endpoint validity as done e.g in DynamicPageEndpointMatcherPolicy, but not here in ApiVersionMatcherPolicy.

    ...
    for (var i = 0; i < candidates.Count; i++)
    {
        // Additional checking.
        if (!candidates.IsValidCandidate(i))
        {
            continue;
        }
    ...

[commonsensesoftware]

With diving into further, I'm just going to assume that this is a bug because the implementation is based off of examples and guidance from the ASP.NET Core team. Thanks for reporting it. I'll work on getting a fix out.