9879fd
From 0ac5caeaed1fa0354e02e0609f2c726b1b72eb8c Mon Sep 17 00:00:00 2001
9879fd
From: Oleg Kalnichevski <olegk@apache.org>
9879fd
Date: Tue, 29 Sep 2020 09:37:38 +0200
9879fd
Subject: [PATCH 3/3] Incorrect handling of malformed authority component by
9879fd
 URIUtils#extractHost
9879fd
9879fd
---
9879fd
 .../apache/http/client/utils/URIUtils.java    | 69 ++++++++-----------
9879fd
 .../http/client/utils/TestURIUtils.java       |  6 +-
9879fd
 2 files changed, 32 insertions(+), 43 deletions(-)
9879fd
9879fd
diff --git a/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java b/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
9879fd
index 8eb7667e3..aa3431f6f 100644
9879fd
--- a/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
9879fd
+++ b/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
9879fd
@@ -419,56 +419,43 @@ public class URIUtils {
9879fd
         if (uri == null) {
9879fd
             return null;
9879fd
         }
9879fd
-        HttpHost target = null;
9879fd
         if (uri.isAbsolute()) {
9879fd
-            int port = uri.getPort(); // may be overridden later
9879fd
-            String host = uri.getHost();
9879fd
-            if (host == null) { // normal parse failed; let's do it ourselves
9879fd
+            if (uri.getHost() == null) { // normal parse failed; let's do it ourselves
9879fd
                 // authority does not seem to care about the valid character-set for host names
9879fd
-                host = uri.getAuthority();
9879fd
-                if (host != null) {
9879fd
+                if (uri.getAuthority() != null) {
9879fd
+                    String content = uri.getAuthority();
9879fd
                     // Strip off any leading user credentials
9879fd
-                    final int at = host.indexOf('@');
9879fd
-                    if (at >= 0) {
9879fd
-                        if (host.length() > at+1 ) {
9879fd
-                            host = host.substring(at+1);
9879fd
-                        } else {
9879fd
-                            host = null; // @ on its own
9879fd
-                        }
9879fd
+                    int at = content.indexOf('@');
9879fd
+                    if (at != -1) {
9879fd
+                        content = content.substring(at + 1);
9879fd
                     }
9879fd
-                    // Extract the port suffix, if present
9879fd
-                    if (host != null) {
9879fd
-                        final int colon = host.indexOf(':');
9879fd
-                        if (colon >= 0) {
9879fd
-                            final int pos = colon + 1;
9879fd
-                            int len = 0;
9879fd
-                            for (int i = pos; i < host.length(); i++) {
9879fd
-                                if (Character.isDigit(host.charAt(i))) {
9879fd
-                                    len++;
9879fd
-                                } else {
9879fd
-                                    break;
9879fd
-                                }
9879fd
-                            }
9879fd
-                            if (len > 0) {
9879fd
-                                try {
9879fd
-                                    port = Integer.parseInt(host.substring(pos, pos + len));
9879fd
-                                } catch (final NumberFormatException ex) {
9879fd
-                                }
9879fd
-                            }
9879fd
-                            host = host.substring(0, colon);
9879fd
+                    final String scheme = uri.getScheme();
9879fd
+                    final String hostname;
9879fd
+                    final int port;
9879fd
+                    at = content.indexOf(":");
9879fd
+                    if (at != -1) {
9879fd
+                        hostname = content.substring(0, at);
9879fd
+                        try {
9879fd
+                            final String portText = content.substring(at + 1);
9879fd
+                            port = !TextUtils.isEmpty(portText) ? Integer.parseInt(portText) : -1;
9879fd
+                        } catch (final NumberFormatException ex) {
9879fd
+                            return null;
9879fd
                         }
9879fd
+                    } else {
9879fd
+                        hostname = content;
9879fd
+                        port = -1;
9879fd
+                    }
9879fd
+                    try {
9879fd
+                        return new HttpHost(hostname, port, scheme);
9879fd
+                    } catch (final IllegalArgumentException ex) {
9879fd
+                        return null;
9879fd
                     }
9879fd
                 }
9879fd
-            }
9879fd
-            final String scheme = uri.getScheme();
9879fd
-            if (!TextUtils.isBlank(host)) {
9879fd
-                try {
9879fd
-                    target = new HttpHost(host, port, scheme);
9879fd
-                } catch (final IllegalArgumentException ignore) {
9879fd
-                }
9879fd
+            } else {
9879fd
+                return new HttpHost(uri.getHost(), uri.getPort(), uri.getScheme());
9879fd
             }
9879fd
         }
9879fd
-        return target;
9879fd
+        return null;
9879fd
     }
9879fd
 
9879fd
     /**
9879fd
diff --git a/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java b/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
9879fd
index 189966635..98a44bc1c 100644
9879fd
--- a/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
9879fd
+++ b/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
9879fd
@@ -273,14 +273,16 @@ public class TestURIUtils {
9879fd
 
9879fd
         Assert.assertEquals(new HttpHost("localhost",8080),
9879fd
                 URIUtils.extractHost(new URI("http://localhost:8080/;sessionid=stuff/abcd")));
9879fd
-        Assert.assertEquals(new HttpHost("localhost",8080),
9879fd
+        Assert.assertEquals(null,
9879fd
                 URIUtils.extractHost(new URI("http://localhost:8080;sessionid=stuff/abcd")));
9879fd
-        Assert.assertEquals(new HttpHost("localhost",-1),
9879fd
+        Assert.assertEquals(null,
9879fd
                 URIUtils.extractHost(new URI("http://localhost:;sessionid=stuff/abcd")));
9879fd
         Assert.assertEquals(null,
9879fd
                 URIUtils.extractHost(new URI("http://:80/robots.txt")));
9879fd
         Assert.assertEquals(null,
9879fd
                 URIUtils.extractHost(new URI("http://some%20domain:80/robots.txt")));
9879fd
+        Assert.assertEquals(null,
9879fd
+                URIUtils.extractHost(new URI("http://blah@goggle.com:80@google.com/")));
9879fd
     }
9879fd
 
9879fd
     @Test
9879fd
-- 
9879fd
2.31.1
9879fd