[HTTPCLIENT-1803] Malformed path not handled well

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.5.1
• Fix Version/s: 4.5.3
• Component/s: HttpClient (async), HttpClient (classic)
• Assignee: Unassigned
• Reporter: Tyler Benson
• Created: 17/Jan/17 22:26
• Updated: 10/Jun/18 12:35
• Resolved: 21/Jan/17 14:46

Description

When using URIBuilder's constructor with a malformed url argument, host passed in by setHost call not honored.

String path = "@notexample.com/mypath"
URI uri = new URIBuilder(path).setHost("example.com").build();
org.junit.Assert.assertEquals("example.com", uri.getHost())

This is caused by the original string being passed into the constructor being treated as the path, but not verifying the presence of a leading / character.
This can be seen with other arguments:

path = "example" -> //example.comexample

Fix: URIBuilder should ensure path starts with a leading /.

Reason priority is considered Major:
In our case, this caused a security vulnerability which was discovered by researcher James Kettle (@albinowax on twitter). The user-provided path was able to override our specified host, resulting in giving network access to a sensitive environment. We worked around this in our code by ensuring the leading /, but this seems like something better handled by the framework.

PS. If you agree this should be fixed, I'm happy to submit a pull request.

Issue Links

• is related to: HADOOP-14868 regression: wasb Mock FS tests failing with
• is related to: DOXIA-576 Upgrade Http Components to 4.4.11 (core) and 4.5.8 (httpclient)