[VALIDATOR-334] UrlValidator: isValidAuthority() returning true when supplied authority validator fails

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.0 Release
• Fix Version/s: 1.4.1 Release
• Component/s: Routines
• Assignee: Unassigned
• Reporter: Scott Franson
• Created: 26/Mar/14 05:51
• Updated: 13/Jan/15 20:02
• Resolved: 03/Jan/15 10:50

Description

When UrlValidator is supplied an authority validator, if the authority fails the authority validator, but is an otherwise valid authority, the UrlValidator reports the URL is valid. Here is a test case:

    @Test
    public void testUrlValidator() throws Exception {
        String regex = ".*amazon\\.com";
        RegexValidator authorityValidator = new RegexValidator(regex);
        UrlValidator validator = new UrlValidator(authorityValidator, UrlValidator.ALLOW_ALL_SCHEMES);

        assertThat("amazon.com", Pattern.matches(regex, "amazon.com"), is(true));
        assertThat("google.com", Pattern.matches(regex, "google.com"), is(false));

        assertThat("amazon.com", authorityValidator.isValid("amazon.com"), is(true));
        assertThat("google.com", authorityValidator.isValid("google.com"), is(false));

        assertThat("amazon.com", validator.isValid("http://amazon.com/somepath"), is(true));
        assertThat("google.com", validator.isValid("http://google.com/somepath"), is(false));   // fails
    }

It appears that UrlAuthority.isValidAuthority() will return true if the URL passes the authorityValidator (line 365). But if the URL fails the authorityValidator, it can still pass the other validation checks. Shouldn't the validation fail if the URL fails the authorityValidator, regardless if it is an otherwise valid authority?

Issue Links

• is related to: VALIDATOR-248 Add an option to allow 'localhost' as a valid hostname part in the URL