17krishna8 opened a new pull request, #1673: URL: https://github.com/apache/wicket/pull/1673
`Url.parse()` handed the port of a full URL to `Integer.parseInt()` without a guard, so a value such as `http://localhost:80x/` made the method throw `NumberFormatException` although nothing else about the URL is invalid, and `Url.parse()` is not documented to throw on malformed input at all. The value is not always application controlled: `ServletWebRequest` reads the base URL of an ajax request from the `Wicket-Ajax-BaseURL` header or the `wicket-ajax-baseurl` parameter and passes it through `Url.parse()`, so a client that sends a malformed value turns an ajax request into a failed one. The websocket handshake parses the same parameter. A port that cannot be parsed now falls back to the default port of the protocol, the same value a URL without a port gets. Everything else is parsed as before, and a valid port is still used. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
