Comment by taspeotis

The author exploited this by adding a space to the URL so it no longer started with http:// rather (space)http:// but it looks like the call to Replace would be ineffective if the URL started with HTTP:// as well.

    bool flag2 = file.Location.ToLower().StartsWith("http://");
    if (flag2)
    {
        file.Location = file.Location.Replace("http://", "https://");
    }

I trust the new version isn’t vulnerable to this...