I believe that's parent's point. "https:" would be OK, "http: would be rejected, but " http:" would also be _accepted_ it. They looked for "
http://" at the start of the string, instead of requiring "
https://".
Replacing:
bool flag2 = file.Location.ToLower().StartsWith("http://");
with:
bool flag2 = Regex.IsMatch(file.Location.ToLower(), "^http:");
doesn't help. You have to make sure to actually replace http, not just check the start of the line.