Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
Expand Down Expand Up @@ -63,12 +62,32 @@ public static String requestToLogString(Request request) {
* @throws URISyntaxException if parameter could not be converted to a URI
*/
public static URI uriFromString(String s) throws MalformedURLException, URISyntaxException {
URL url = new URL(s);
URI uri = new URI(url.getProtocol(), url.getUserInfo(), IDN.toASCII(url.getHost()), url.getPort(),
url.getPath(), url.getQuery(), url.getRef());
URI uri = parse(s);
return URI.create(uri.toASCIIString().replace("+", "%2B").replace("%25%25", "%"));
}

private static final Pattern URL_PATTERN = Pattern.compile("^(?:(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):)?//?"
Copy link

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern makes the '//' after the scheme optional with '//?', which incorrectly allows malformed URLs like 'http:example.com'. RFC 3986 requires '//' for authority-based URIs. The pattern should use '//(' to make the entire authority section optional, or '//' if authority is required.

Suggested change
private static final Pattern URL_PATTERN = Pattern.compile("^(?:(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):)?//?"
private static final Pattern URL_PATTERN = Pattern.compile("^(?:(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):)?//"

Copilot uses AI. Check for mistakes.

+ "(?:(?<userinfo>[^@/?#]*)@)?" + "(?<host>[^:/?#]*)(?::(?<port>\\d+))?" + "(?<path>/[^?#]*)?"
Copy link

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The path pattern requires a leading slash with '/[^?#]', but paths can be relative or empty. This will fail to parse valid URIs like 'http://example.com' (empty path) or 'http://example.com?query' (no path). Change to '(?[^?#])?' to allow any path including empty.

Suggested change
+ "(?:(?<userinfo>[^@/?#]*)@)?" + "(?<host>[^:/?#]*)(?::(?<port>\\d+))?" + "(?<path>/[^?#]*)?"
+ "(?:(?<userinfo>[^@/?#]*)@)?" + "(?<host>[^:/?#]*)(?::(?<port>\\d+))?" + "(?<path>[^?#]*)?"

Copilot uses AI. Check for mistakes.

+ "(?:\\?(?<query>[^#]*))?" + "(?:#(?<fragment>.*))?");

public static URI parse(String url) throws URISyntaxException {
Matcher m = URL_PATTERN.matcher(url.trim());
if (!m.matches()) {
throw new URISyntaxException(url, "Invalid URL");
}

String host = m.group("host");
if (host != null) {
host = IDN.toASCII(host); // <-- convert Unicode to ASCII
}

String portStr = m.group("port");
int port = (portStr != null && !portStr.isEmpty()) ? Integer.parseInt(portStr) : -1;

return new URI(m.group("scheme"), m.group("userinfo"), host, port, m.group("path"), m.group("query"),
m.group("fragment"));
}

/**
* Format a string using {@link String#format(String, Object...)} but allow non-format percent characters
*
Expand Down