reta commented on PR #3596:
URL: https://github.com/apache/cxf/pull/3596#issuecomment-6304008824
> There is one remaining gap - the ; case that was kept for the TCK still
writes the path straight after the host with no /. @ is a legal path character,
so it isn’t encoded.
@coheigea with this one we opened a pandora box, sadly:
- non encoded: `URI.create("http://foo.com;@evil.com";).getHost() ->
"evil.com"`
- encoding does not work:
`URI.create("http://foo.com;%40evil.com";).getHost() -> null`
But it is not just `;`, I found these ones:
- non encoded: `URI.create("http://foo.com&@evil.com";).getHost()` ->
"evil.com"`
- encoding does not work:
`URI.create("http://foo.com&%40evil.com";).getHost() -> null`
- non encoded: `URI.create("http://[email protected]";).getHost()` ->
"evil.com"`
- encoding does not work:
`URI.create("http://foo.com+%40evil.com";).getHost() -> null`
The only reliable way that I found is to use leading slash in front of path:
-> URI.create("http://foo.com/;@evil.com";).getHost() -> "foo.com"
-> URI.create("http://foo.com/&@evil.com";).getHost() -> "foo.com"
-> URI.create("http://foo.com/[email protected]";).getHost() -> "foo.com"
Alternatively, we could fail with an exception but that could be surprising.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
