HostPort needs updates for spec compliance
- Dominant language
- Java
- Stars
- 4.1k
- Forks
- 2k
- Avg merge
- 3d 56m
- Merged PRs (30d)
- 48
Description
**Jetty version(s)**
9.4+
**Java version/vendor** `(use: java -version)`
All
**OS type/version**
Alll
**Description**
Currently `HostPort` allows odd authorities that make no sense.
```
Host: :9999
Host: -
Host: -:8888
Host: *
Host: *:2222
Host: *.eclipse.org
```
I think `HostPort` should validate the `host` portion a bit more, to reject these nonsense hosts with a 400 Bad Request.
The spec for HTTP at https://datatracker.ietf.org/doc/html/rfc7230#section-5.4
Says the `uri-host` for http is detailed in https://datatracker.ietf.org/doc/html/rfc7230#section-2.7.1
Which points to `host` in https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
which has the following ABNF ...
```
uri-host =
host = IP-literal / IPv4address / reg-name
IP-literal = "[" ( IPv6address / IPvFuture ) "]"
IPv6address = 6( h16 ":" ) ls32
/ "::" 5( h16 ":" ) ls32
/ [ h16 ] "::" 4( h16 ":" ) ls32
/ [ *1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32
/ [ *2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32
/ [ *3( h16 ":" ) h16 ] "::" h16 ":" ls32
/ [ *4( h16 ":" ) h16 ] "::" ls32
/ [ *5( h16 ":" ) h16 ] "::" h16
/ [ *6( h16 ":" ) h16 ] "::"
ls32 = ( h16 ":" h16 ) / IPv4address
; least-significant 32 bits of address
h16 = 1*4HEXDIG
; 16 bits of address represented in hexadecimal
IPvFuture = "v" 1*HEXDIG "." 1*( unreserved / sub-delims / ":" )
IPv4address = dec-octet "." dec-octet "." dec-octet "." dec-octet
dec-octet = DIGIT ; 0-9
/ %x31-39 DIGIT ; 10-99
/ "1" 2DIGIT ; 100-199
/ "2" %x30-34 DIGIT ; 200-249
/ "25" %x30-35 ; 250-255
reg-name = *( unreserved / pct-encoded / sub-delims )
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
pct-encoded = "%" HEXDIG HEXDIG
sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
/ "*" / "+" / "," / ";" / "="
```
Optionally, this validation could exist as a `RejectInvalidAuthorityCustomizer` (like proposed in PR #7251).
Contributor guide
Assessment
This issue has not been assessed yet.