This is an automated email from the ASF dual-hosted git repository. tballison pushed a commit to branch TIKA-4809-stage-9 in repository https://gitbox.apache.org/repos/asf/tika.git
commit f1527e1b42e3f277cb1881ed3f20a552d06fdbe4 Author: tallison <[email protected]> AuthorDate: Tue Aug 11 07:54:47 2026 -0400 TIKA-4809: Remove the inert redirect host allowlist --- .../org/apache/tika/client/HttpClientFactory.java | 34 ++-------------------- 1 file changed, 3 insertions(+), 31 deletions(-) diff --git a/tika-pipes/tika-httpclient-commons/src/main/java/org/apache/tika/client/HttpClientFactory.java b/tika-pipes/tika-httpclient-commons/src/main/java/org/apache/tika/client/HttpClientFactory.java index 51e58ca9b4..2c97406e38 100644 --- a/tika-pipes/tika-httpclient-commons/src/main/java/org/apache/tika/client/HttpClientFactory.java +++ b/tika-pipes/tika-httpclient-commons/src/main/java/org/apache/tika/client/HttpClientFactory.java @@ -28,8 +28,6 @@ import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; import java.util.Arrays; import java.util.Base64; -import java.util.HashSet; -import java.util.Set; import javax.crypto.BadPaddingException; import javax.crypto.Cipher; import javax.crypto.IllegalBlockSizeException; @@ -96,7 +94,6 @@ public class HttpClientFactory { private String proxyHost; private int proxyPort; - private Set<String> allowedHostsForRedirect = new HashSet<>(); private int maxConnectionsPerRoute = 1000; private int maxConnections = 2000; private int requestTimeoutMillis = 120000; @@ -127,14 +124,6 @@ public class HttpClientFactory { this.proxyPort = proxyPort; } - public Set<String> getAllowedHostsForRedirect() { - return allowedHostsForRedirect; - } - - public void setAllowedHostsForRedirect(Set<String> allowedHostsForRedirect) { - this.allowedHostsForRedirect = allowedHostsForRedirect; - } - public int getMaxConnectionsPerRoute() { return maxConnectionsPerRoute; } @@ -248,7 +237,6 @@ public class HttpClientFactory { public HttpClientFactory copy() throws TikaConfigException { HttpClientFactory cp = new HttpClientFactory(); - cp.setAllowedHostsForRedirect(new HashSet<>(allowedHostsForRedirect)); cp.setAuthScheme(authScheme); cp.setConnectTimeoutMillis(connectTimeoutMillis); cp.setCredentialsAESEncrypted(credentialsAESEncrypted); @@ -310,7 +298,7 @@ public class HttpClientFactory { addProxy(builder); return builder.setConnectionManager(manager) .evictExpiredConnections() - .setRedirectStrategy(new CustomRedirectStrategy(allowedHostsForRedirect)) + .setRedirectStrategy(new CustomRedirectStrategy()) .setDefaultRequestConfig(RequestConfig.custom().setTargetPreferredAuthSchemes( Arrays.asList(AuthSchemes.BASIC, AuthSchemes.NTLM)) .setConnectionRequestTimeout(requestTimeoutMillis) @@ -402,11 +390,6 @@ public class HttpClientFactory { private static class CustomRedirectStrategy extends LaxRedirectStrategy { private static final Logger LOG = LoggerFactory.getLogger(CustomRedirectStrategy.class); - private final Set<String> allowedHosts; - - public CustomRedirectStrategy(Set<String> allowedHosts) { - this.allowedHosts = allowedHosts; - } @Override protected URI createLocationURI(final String location) throws ProtocolException { @@ -430,20 +413,9 @@ public class HttpClientFactory { throws ProtocolException { boolean isRedirectedSuper = super.isRedirected(request, response, context); if (isRedirectedSuper) { + // A present-but-blank Location would otherwise blow up in getLocationURI. Header locationHeader = response.getFirstHeader("Location"); - String location = locationHeader.getValue(); - if (StringUtils.isBlank(location)) { - return false; - } - URI uri; - try { - uri = new URI(location); - } catch (URISyntaxException e) { - return true; - } - if (!allowedHosts.isEmpty() && !allowedHosts.contains(uri.getHost())) { - LOG.warn("Not allowing external redirect. OriginalUrl={}," + - " RedirectLocation={}", request.getRequestLine().getUri(), location); + if (StringUtils.isBlank(locationHeader.getValue())) { return false; } }
