This is an automated email from the ASF dual-hosted git repository.
janhoy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new beeabff8e4d SOLR-18293: Use URLUtil#hasScheme for URL scheme detection
in AllowListUrlChecker
beeabff8e4d is described below
commit beeabff8e4d724e196d8631abe089d4d02f106ba
Author: Jan Høydahl <[email protected]>
AuthorDate: Wed Sep 9 18:12:43 2026 +0200
SOLR-18293: Use URLUtil#hasScheme for URL scheme detection in
AllowListUrlChecker
---
.../apache/solr/security/AllowListUrlChecker.java | 24 +++-------------------
.../solr/security/AllowListUrlCheckerTest.java | 11 +++++++++-
2 files changed, 13 insertions(+), 22 deletions(-)
diff --git
a/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
b/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
index 5c85c4ee776..ca1a9f5e82b 100644
--- a/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
+++ b/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
@@ -25,12 +25,11 @@ import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
import java.util.stream.Collectors;
import org.apache.solr.common.SolrException;
import org.apache.solr.common.cloud.ClusterState;
import org.apache.solr.common.util.EnvUtils;
+import org.apache.solr.common.util.URLUtil;
import org.apache.solr.core.NodeConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -78,12 +77,6 @@ public class AllowListUrlChecker {
}
}
- /**
- * Regex pattern to match any protocol, e.g. http:// https:// s3://. After a
match, regex group 1
- * contains the protocol and group 2 the rest.
- */
- private static final Pattern PROTOCOL_PATTERN =
Pattern.compile("(\\w+)(://.*)");
-
/**
* Allow list of hosts. Elements in the list are formatted as host:port (no
protocol or context).
*/
@@ -219,20 +212,9 @@ public class AllowListUrlChecker {
}
private static String parseHostPort(String url) throws MalformedURLException
{
- // Parse the host and port.
- // It doesn't really matter which protocol we set here because we are not
going to use it.
+ // Detect the scheme the same way the shard URL fetch does
(URLUtil#hasScheme).
url = url.trim();
- URI u;
- Matcher protocolMatcher = PROTOCOL_PATTERN.matcher(url);
- if (protocolMatcher.matches()) {
- // Replace any protocol unsupported by URL.
- if (!protocolMatcher.group(1).startsWith("http")) {
- url = "http" + protocolMatcher.group(2);
- }
- u = URI.create(url);
- } else {
- u = URI.create("http://"; + url);
- }
+ URI u = URI.create(URLUtil.hasScheme(url) ? url : "http://"; + url);
if (u.getHost() == null || u.getPort() < 0) {
throw new MalformedURLException("Invalid host or port in '" + url + "'");
}
diff --git
a/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
b/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
index 4123d4a7c49..aa1d6f0d3c2 100644
--- a/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
+++ b/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
@@ -109,7 +109,16 @@ public class AllowListUrlCheckerTest extends
SolrTestCaseJ4 {
new AllowListUrlChecker(
urls("http://abc-1.com:8983";, "http://abc-2.com:8983";,
"http://abc-3.com:8983";));
checker.checkAllowList(urls("https://abc-1.com:8983/solr";,
"https://abc-2.com:8983/solr";));
- checker.checkAllowList(urls("s3://abc-1.com:8983/solr"));
+
+ // Prefixes not recognized by URLUtil#hasScheme are not schemes, so these
URLs are rejected.
+ for (String url :
+ urls(
+ "12345://abc-1.com:8983/solr",
+ "HTTP://abc-1.com:8983/solr",
+ "s3://abc-1.com:8983/solr")) {
+ expectThrows(
+ MalformedURLException.class, () ->
AllowListUrlChecker.parseHostPorts(List.of(url)));
+ }
}
@Test
