fix(1485) Reference parsing issues by thboileau · Pull Request #1486 · restlet/restlet-framework-java

thboileau · 2026-02-22T21:40:36Z

The aim

Fix parsing of Reference instances as reported in ticket 1485

Check-list

PR size
- Under 300 lines ✅
- Can't be split without complicating the process even more
Tests
- Added
- Not applicable (why?)
Doc
- Added
- Not applicable
Reviewer
- Asked for a review
- Added label DO NOT REVIEW

thboileau · 2026-02-22T22:02:46Z

 			newPart = newAuthority;
 		} else if (oldPart.startsWith("//")) {
-			int index = oldPart.indexOf('/', 2);
+			int indexSlash = oldPart.indexOf('/', 2);


we have to take care of the case where the "/" comes from the query string (because of the call to getSchemeSpecificPart()).

thboileau · 2026-02-22T22:05:05Z

 			// Existing fragment
 			if (fragment != null) {
-				this.internalRef = this.internalRef.substring(0, this.fragmentIndex + 1) + fragment;
+				setInternalRef(this.internalRef.substring(0, this.fragmentIndex + 1) + fragment);


Intellij complains when this.internalRef is set with a value computed thanks to itself, because it's a volatile class member. It leads to use a setter.

thboileau · 2026-02-22T22:05:51Z

-					// Path found
-					final int index2 = oldPart.indexOf('?');
+				final int indexSlash = oldPart.indexOf('/', 2);
+				final int indexQuery = oldPart.indexOf('?', 2);


we have to take care of the case where the "/" comes from the query string (because of the call to getSchemeSpecificPart()).

thboileau · 2026-02-22T22:07:13Z

-import org.restlet.engine.header.HeaderConstants;
-import org.restlet.engine.util.ReferenceUtils;
-import org.restlet.util.Series;
+import static org.junit.jupiter.api.Assertions.assertEquals;


The class has been reworked to make it shorter using Junit parameterized tests

thboileau · 2026-02-22T22:07:44Z

+             "http://localhost/abc?query#fragment,/def",
+             "http://localhost/abc#fragment?query,/def",
+             "http://localhost#fragment/abc?query,/def",
+             "http://localhost?query/abc,/def"


this case was failing (case where '/' is inside the query)

thboileau · 2026-02-22T22:08:19Z

        Reference originalRef = ReferenceUtils.getOriginalRef(ref, headers);
-        assertEquals(originalRef.getSchemeProtocol(), Protocol.HTTPS);
-        assertEquals(originalRef.getHostPort(), 123);
+        assertEquals(Protocol.HTTPS, originalRef.getSchemeProtocol());


switch the expected value in first position.

thboileau · 2026-02-22T22:08:50Z

        assertEquals("/foo/", parentRef.toString());
    }

-    /**


this part has especially been reworked to make it shorter

thboileau · 2026-02-22T22:09:28Z

-                "http://host.com/dir/sub", "http://host.com/dir/sub",
-                "http://host.com/dir/sub", null, null);
+    @Nested
+    class TestParsing {


isolate "parsing" test cases (nice presentation in Intellij)

thboileau · 2026-02-22T22:12:25Z

                        "http://www.gamasutra.com/view/feature/177267/devil_may_cry_born_again.php"),
                ref).getTargetRef();
        assertEquals(
-                "http://twitter.com?status=RT%20@gamasutra:%20%20Devil%20May%20Cry%20:%20Born%20Again%20http:?status=RT%20@gamasutra:%20%20Devil%20May%20Cry%20:%20Born%20Again%20http://www.gamasutra.com/view/feature/177267/",


The previous test was wrong.
It showed this log

Can't parse hostPort : [hostRef,requestUri]=[null,http://twitter.com?status=RT%20@gamasutra:%20%20Devil%20May%20Cry%20:%20Born%20Again%20http:?status=RT%20@gamasutra:%20%20Devil%20May%20Cry%20:%20Born%20Again%20http://www.gamasutra.com/view/feature/177267/]

thboileau · 2026-02-22T22:13:32Z

-			index = part.indexOf('?');
-			if (index != -1) {
-				return part.substring(2, index);
+			// At this point, no fragment, but a query string may come from


we have to take care of the case where the '/' is inside the query

thboileau · 2026-02-23T13:52:19Z

+                "http://localhost/?query,http,localhost,/,query,",
+                "http://localhost/#?query,http,localhost,/,,?query",
+                "http://localhost/path#frag/ment,http,localhost,/path,,frag/ment",
+                "http://localhost/path?qu/ery,http,localhost,/path,qu/ery,"


This case was failing ('/' inside query)

thboileau · 2026-02-23T13:53:20Z

        assertEquals("http://localhost:1234/test/last", ref.toString());
    }

+


thboileau · 2026-02-23T13:53:42Z

        ref = new Reference(uri);
        assertEquals("file:///C%7C/wherever%5Cwhatever.swf", ref.toString());
    }
+


thboileau · 2026-02-23T20:48:18Z

 import java.util.ArrayList;
 import java.util.List;
 import java.util.logging.Level;
+import java.util.regex.Pattern;


formatting implies order of "imports" as well... we will take care of that later

sonarqubecloud · 2026-03-08T22:06:15Z

Quality Gate failed

Failed conditions
7.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

jlouvel · 2026-05-14T19:17:49Z

+	/**
+	 * Validate a segment of an IP V6 according to RFC 2373.
+	 */
+	private void validateIpV6Part(final String part, final int doubleColonCount) {


This still accepts malformed IPv6 hextets because validateIpV6Part allows any alphabetic character, not just hex digits. I reproduced that https://[1:2:3:4:5:6:7:zzzz]/ and https://[1:2:3:4:5:6:7:gggg]/ both return an authority instead of throwing, so the hardening can be bypassed with non-hex segments.

jlouvel · 2026-05-14T19:17:50Z

+	/**
+	 * Validate the user info part of the authority, and return the remaining part of the authority.
+	 */
+	private String validateUserInfoAndReturnRemaining(final String authority) {


This helper only strips everything through the first @ and never rejects another one later in the authority. Inputs like https://user@@host/ and https://user@host@evil/ still pass getAuthority(), so malformed user-info authorities are not actually blocked by the new validation.

jlouvel · 2026-05-14T19:17:51Z

+		}
+	}
+
+	private String validateIpV6AndReturnRemaining(String authority) {


This now rejects valid IPv6 literals with an embedded IPv4 tail, for example https://[::ffff:192.168.0.1]/. validateIpV6Part forbids dots and caps each segment at four characters, so legal IPv4-mapped IPv6 addresses now throw IllegalArgumentException, which is a compatibility regression.

thboileau force-pushed the 1485_reference_parsing_issues branch 2 times, most recently from 9b06b9e to 1a66044 Compare February 22, 2026 21:46

thboileau commented Feb 22, 2026

View reviewed changes

thboileau force-pushed the 1485_reference_parsing_issues branch from b45080f to b8f3258 Compare February 22, 2026 22:19

thboileau requested a review from jlouvel February 22, 2026 22:28

thboileau commented Feb 23, 2026

View reviewed changes

fix(1485) Reference parsing issues

8928a03

thboileau force-pushed the 1485_reference_parsing_issues branch from b8f3258 to 8928a03 Compare March 8, 2026 20:18

Taken into account PR review comments

ba873a2

thboileau force-pushed the 1485_reference_parsing_issues branch from 5b4923e to ba873a2 Compare March 8, 2026 22:00

Taken into account PR review comments

d65cf5b

jlouvel reviewed May 14, 2026

View reviewed changes

jlouvel assigned thboileau May 14, 2026

thboileau closed this May 16, 2026

thboileau deleted the 1485_reference_parsing_issues branch May 16, 2026 12:52

		assertEquals("http://localhost:1234/test/last", ref.toString());
		}

Conversation

thboileau commented Feb 22, 2026

The aim

Check-list

Uh oh!

thboileau Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thboileau Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thboileau Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thboileau Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Mar 8, 2026

Quality Gate failed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

thboileau Feb 22, 2026 •

edited

Loading

thboileau Feb 22, 2026 •

edited

Loading

thboileau Feb 22, 2026 •

edited

Loading

thboileau Feb 22, 2026 •

edited

Loading