-
Notifications
You must be signed in to change notification settings - Fork 24
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JBEAP-27450 Normalize URL notation via URI.toURL().toExternalForm() #737
JBEAP-27450 Normalize URL notation via URI.toURL().toExternalForm() #737
Conversation
25f29f4
to
0aaf4ea
Compare
Cc @spyrkob |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@TomasHofman there are some problems with using URI class - I added some notes below.
} catch (MalformedURLException e) { | ||
return false; | ||
uri = new URI(location); | ||
if (("file".equals(uri.getScheme()) || StringUtils.isBlank(uri.getScheme())) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think there are some legal paths that would not be caught by this. For example, on Windows - D:/Foo/Bar
, on Linux a:foo/bar
. In both cases the first letter is treated as a schema and so the whole path will be treated as a URI and fail on uri.toURL()
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Technically I think Windows D:/Foo/Bar
should not be allowed because it's not a URL, but it should be handled gracefully by the catch (URISyntaxException e)
block bellow.
On Linux, a:foo/bar
can as well be http:foo/bar
and now how do we tell if it should be treated as URL or a path?
This is a hole we dug ourselves by being too benevolent about the input, we should have insisted on a URL :).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hmm a:foo/bar is not a URL protocol we support, therefore we should treat it as a path... but yes I get what you're saying. D:/Foo/Bar
on the other hand is not an URL to start with, it's a path
prospero-cli/src/main/java/org/wildfly/prospero/cli/RepositoryDefinition.java
Outdated
Show resolved
Hide resolved
Thanks @spyrkob for reviewing, I didn't thought of the Windows inputs. (And the Windows jobs did fail, which is good to see that we have coverage!) |
ce6b648
to
9906b35
Compare
@spyrkob I believe I managed to sort out the Windows paths. I think that we allow a weird mixture of things, while disallowing different things of the same kind. For instance we have test cases where we test that pure paths (not URLs) are accepted (in this case absolute paths): prospero/prospero-cli/src/test/java/org/wildfly/prospero/cli/RepositoryDefinitionTest.java Line 145 in 9906b35
Different test checks that a non-URL string is refused based on having invalid format: prospero/prospero-cli/src/test/java/org/wildfly/prospero/cli/RepositoryDefinitionTest.java Line 89 in 9906b35
On yet different place we test that the same kind of non-URL string is refused based on the path not being an existing file: prospero/prospero-cli/src/test/java/org/wildfly/prospero/cli/RepositoryDefinitionTest.java Line 172 in 9906b35
From a little different angle, we are inconsistent in that we allow relative paths in URL form ("file:some/path"), but don't allow relative paths in path form ("some/path"), yet we allow absolute paths in path form ("/some/path"). I'm not sure though if we should change that due to backward compatibility. (At least we probably shouldn't make it stricter.) |
9906b35
to
fbac3af
Compare
Updated comments in the code. |
@TomasHofman I agree :( Originally this only allowed URLs, later we got a request to support local files as well, hence this logic changed and got overcomplicated over time. The relative URL itself is an unexpected effect of maven library allowing it, by the time I realised this is possible, we couldn't block it easily due to backwards compatibility (at least in 1.1.x branch).
We should allow relative paths
That's an incorrect test - probably hasn't been removed when support of local files has been added. Also that shows that the check in the test is not enough, the test should check the reason why the value is removed The summary of allowed values is:
On top of that, each of this can have an ID suffix |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thanks @TomasHofman
I think I still need to handle |
yes of course, sorry 🤦 |
0647562
to
0b02cd8
Compare
Also tried so simplify the RepositoryDefinition class.
0b02cd8
to
fd6c1ac
Compare
When you do I tried to do a comparison to the original impl and I do get mostly the same results, except that the current impl allows some notations that threw exceptions before, like:
They do not seem to be very sensible, so we could just explicitly forbid any remote URLs (two slashes) in the file schema. We could also enforce only http and https for the remote URLs. Then we have the option to throw all this away and keep the original impl, just do the bare minimum to prefer the one slash notation over the three slashes notation... |
Thanks for the detailed summary @TomasHofman!
+1 to forbidding the remote file URLs especially if we already blocked that before. I'm thinking more and more that we should have supported http/https URLs and local file paths (without |
229d9d3
to
55d5f64
Compare
55d5f64
to
01128f0
Compare
Added new commit to try to enforce http / https / file schemas, and file only for local URLs (no host). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thanks @TomasHofman
This went bit farther than just calling
URL.toExternalForm()
. I tried to simplify theRepositoryDefinition
class a bit.