Class HttpURI
http://user@host:port/path;param1/%2e/info;param2?query#fragment
this class will split it into the following optional elements:getScheme()
- http:getAuthority()
- //name@host:portgetHost()
- hostgetPort()
- portgetPath()
- /path;param1/%2e/info;param2getDecodedPath()
- /path/infogetParam()
- param2getQuery()
- querygetFragment()
- fragment
The path part of the URI is provided in both raw form (getPath()
) and
decoded form (getDecodedPath()
), which has: path parameters removed,
percent encoded characters expanded and relative segments resolved. This approach
is somewhat contrary to RFC3986
which no longer defines path parameters (removed after
RFC2396) and specifies
that relative segment normalization should take place before percent encoded character
expansion. A literal interpretation of the RFC can result in URI paths with ambiguities
when viewed as strings. For example, a URI of /foo%2f..%2fbar
is technically a single
segment of "/foo/../bar", but could easily be misinterpreted as 3 segments resolving to "/bar"
by a file system.
Thus this class avoid and/or detects such ambiguities. Furthermore, by decoding characters and
removing parameters before relative path normalization, ambiguous paths will be resolved in such
a way to be non-standard-but-non-ambiguous to down stream interpretation of the decoded path string.
The violations are recorded and available by API such as hasAmbiguousSegment()
so that requests
containing them may be rejected in case the non-standard-but-non-ambiguous interpretations
are not satisfactory for a given compliance configuration.
Implementations that wish to process ambiguous URI paths must configure the compliance modes
to accept them and then perform their own decoding of getPath()
.
If there are multiple path parameters, only the last one is returned by getParam()
.
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionprivate static enum
(package private) static enum
Violations of safe URI interpretations -
Field Summary
Fields -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprivate void
checkSegment
(String uri, int segment, int end, boolean param) Check for ambiguous path segments.void
clear()
static HttpURI
createHttpURI
(String scheme, String host, int port, String path, String param, String query, String fragment) Construct a normalized URI.void
decodeQueryTo
(MultiMap<String> parameters) void
decodeQueryTo
(MultiMap<String> parameters, String encoding) void
decodeQueryTo
(MultiMap<String> parameters, Charset encoding) boolean
getHost()
getParam()
Get a URI path parameter.getPath()
The parsed Path.int
getPort()
getQuery()
getUser()
boolean
boolean
boolean
boolean
boolean
int
hashCode()
boolean
hasQuery()
boolean
(package private) boolean
hasViolation
(HttpURI.Violation violation) boolean
boolean
boolean
void
void
private void
parse
(HttpURI.State state, String uri, int offset, int end) void
parseConnect
(String uri) Deprecated.void
parseRequestTarget
(String method, String uri) Parse according to https://tools.ietf.org/html/rfc7230#section-5.3void
setAuthority
(String host, int port) void
void
void
setPathQuery
(String pathQuery) void
void
toString()
toURI()
-
Field Details
-
__ambiguousSegments
-
_scheme
-
_user
-
_host
-
_port
private int _port -
_path
-
_param
-
_query
-
_fragment
-
_uri
-
_decodedPath
-
_violations
-
_emptySegment
private boolean _emptySegment
-
-
Constructor Details
-
HttpURI
public HttpURI() -
HttpURI
-
HttpURI
-
HttpURI
-
HttpURI
-
HttpURI
-
HttpURI
-
-
Method Details
-
createHttpURI
public static HttpURI createHttpURI(String scheme, String host, int port, String path, String param, String query, String fragment) Construct a normalized URI. Port is not set if it is the default port.- Parameters:
scheme
- the URI schemehost
- the URI hoseport
- the URI portpath
- the URI pathparam
- the URI paramquery
- the URI queryfragment
- the URI fragment- Returns:
- the normalized URI
-
clear
public void clear() -
parse
-
parseRequestTarget
Parse according to https://tools.ietf.org/html/rfc7230#section-5.3- Parameters:
method
- the request methoduri
- the request uri
-
parseConnect
Deprecated. -
parse
-
parse
-
checkSegment
Check for ambiguous path segments. An ambiguous path segment is one that is perhaps technically legal, but is considered undesirable to handle due to possible ambiguity. Examples include segments like '..;', '%2e', '%2e%2e' etc.- Parameters:
uri
- The URI stringsegment
- The inclusive starting index of the segment (excluding any '/')end
- The exclusive end index of the segment
-
hasAmbiguousSegment
public boolean hasAmbiguousSegment()- Returns:
- True if the URI has a possibly ambiguous segment like '..;' or '%2e%2e'
-
hasAmbiguousEmptySegment
public boolean hasAmbiguousEmptySegment()- Returns:
- True if the URI empty segment that is ambiguous like '//' or '/;param/'.
-
hasAmbiguousSeparator
public boolean hasAmbiguousSeparator()- Returns:
- True if the URI has a possibly ambiguous separator of %2f
-
hasAmbiguousParameter
public boolean hasAmbiguousParameter()- Returns:
- True if the URI has a possibly ambiguous path parameter like '..;'
-
hasAmbiguousEncoding
public boolean hasAmbiguousEncoding()- Returns:
- True if the URI has an encoded '%' character.
-
isAmbiguous
public boolean isAmbiguous()- Returns:
- True if the URI has either an
hasAmbiguousSegment()
orhasAmbiguousEmptySegment()
orhasAmbiguousSeparator()
orhasAmbiguousParameter()
-
hasViolations
public boolean hasViolations()- Returns:
- True if the URI has any Violations.
-
hasViolation
-
hasUtf16Encoding
public boolean hasUtf16Encoding()- Returns:
- True if the URI encodes UTF-16 characters with '%u'.
-
getScheme
-
getHost
-
getPort
public int getPort() -
getPath
The parsed Path.- Returns:
- the path as parsed on valid URI. null for invalid URI.
-
getDecodedPath
- Returns:
- The decoded canonical path.
- See Also:
-
getParam
Get a URI path parameter. Multiple and in segment parameters are ignored and only the last trailing parameter is returned.- Returns:
- The last path parameter or null
-
setParam
-
getQuery
-
hasQuery
public boolean hasQuery() -
getFragment
-
decodeQueryTo
-
decodeQueryTo
public void decodeQueryTo(MultiMap<String> parameters, String encoding) throws UnsupportedEncodingException - Throws:
UnsupportedEncodingException
-
decodeQueryTo
public void decodeQueryTo(MultiMap<String> parameters, Charset encoding) throws UnsupportedEncodingException - Throws:
UnsupportedEncodingException
-
isAbsolute
public boolean isAbsolute() -
toString
-
equals
-
hashCode
public int hashCode() -
setScheme
-
setAuthority
- Parameters:
host
- the hostport
- the port
-
setPath
- Parameters:
path
- the path
-
setPathQuery
-
setQuery
-
toURI
- Throws:
URISyntaxException
-
getPathQuery
-
getAuthority
-
getUser
-