This is an automated email from the ASF dual-hosted git repository.
janhoy pushed a commit to branch branch_9x
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/branch_9x by this push:
new b1bad6ca4f5 SOLR-18293: Use URLUtil#hasScheme for URL scheme detection
in AllowListUrlChecker
b1bad6ca4f5 is described below
commit b1bad6ca4f59d55b26f688404c385d1568653c6e
Author: Jan Høydahl <[email protected]>
AuthorDate: Wed Sep 9 18:12:43 2026 +0200
SOLR-18293: Use URLUtil#hasScheme for URL scheme detection in
AllowListUrlChecker
(cherry picked from commit e0e69af86d7689702e2572e051ee0b8945852c43)
---
.../apache/solr/security/AllowListUrlChecker.java | 24 ++++------------------
.../solr/security/AllowListUrlCheckerTest.java | 11 +++++++++-
2 files changed, 14 insertions(+), 21 deletions(-)
diff --git
a/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
b/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
index 9fbffc4cdfb..a83945db6f1 100644
--- a/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
+++ b/solr/core/src/java/org/apache/solr/security/AllowListUrlChecker.java
@@ -25,11 +25,10 @@ import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
import java.util.stream.Collectors;
import org.apache.solr.common.SolrException;
import org.apache.solr.common.cloud.ClusterState;
+import org.apache.solr.common.util.URLUtil;
import org.apache.solr.core.NodeConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -78,12 +77,8 @@ public class AllowListUrlChecker {
}
/**
- * Regex pattern to match any protocol, e.g. http:// https:// s3://. After a
match, regex group 1
- * contains the protocol and group 2 the rest.
+ * Allow list of hosts. Elements in the list are formatted as host:port (no
protocol or context).
*/
- private static final Pattern PROTOCOL_PATTERN =
Pattern.compile("(\\w+)(://.*)");
-
- /** Allow list of hosts. Elements in the list will be host:port (no protocol
or context). */
private final Set<String> hostAllowList;
private volatile Set<String> liveHostUrlsCache;
@@ -218,20 +213,9 @@ public class AllowListUrlChecker {
}
private static String parseHostPort(String url) throws MalformedURLException
{
- // Parse the host and port.
- // It doesn't really matter which protocol we set here because we are not
going to use it.
+ // Detect the scheme the same way the shard URL fetch does
(URLUtil#hasScheme).
url = url.trim();
- URI u;
- Matcher protocolMatcher = PROTOCOL_PATTERN.matcher(url);
- if (protocolMatcher.matches()) {
- // Replace any protocol unsupported by URL.
- if (!protocolMatcher.group(1).startsWith("http")) {
- url = "http" + protocolMatcher.group(2);
- }
- u = URI.create(url);
- } else {
- u = URI.create("http://"; + url);
- }
+ URI u = URI.create(URLUtil.hasScheme(url) ? url : "http://"; + url);
if (u.getHost() == null || u.getPort() < 0) {
throw new MalformedURLException("Invalid host or port in '" + url + "'");
}
diff --git
a/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
b/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
index 0a4f57ba5af..b93b663fe7f 100644
--- a/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
+++ b/solr/core/src/test/org/apache/solr/security/AllowListUrlCheckerTest.java
@@ -111,7 +111,16 @@ public class AllowListUrlCheckerTest extends
SolrTestCaseJ4 {
new AllowListUrlChecker(
urls("http://abc-1.com:8983";, "http://abc-2.com:8983";,
"http://abc-3.com:8983";));
checker.checkAllowList(urls("https://abc-1.com:8983/solr";,
"https://abc-2.com:8983/solr";));
- checker.checkAllowList(urls("s3://abc-1.com:8983/solr"));
+
+ // Prefixes not recognized by URLUtil#hasScheme are not schemes, so these
URLs are rejected.
+ for (String url :
+ urls(
+ "12345://abc-1.com:8983/solr",
+ "HTTP://abc-1.com:8983/solr",
+ "s3://abc-1.com:8983/solr")) {
+ expectThrows(
+ MalformedURLException.class, () ->
AllowListUrlChecker.parseHostPorts(List.of(url)));
+ }
}
@Test
