Integrated: JDK-8288207: Enhance MalformedURLException in Uri.parseCompat
Matthias Baesken
mbaesken at openjdk.java.net
Wed Jun 15 06:55:58 UTC 2022
On Fri, 10 Jun 2022 12:16:17 GMT, Matthias Baesken <mbaesken at openjdk.org> wrote:
> When trying to construct an LdapURL object with a bad input string (in this example the _ in ad_jbs is causing issues), and not using
> the backward compatibility flag -Dcom.sun.jndi.ldapURLParsing="legacy" we run into the exception below :
>
> import com.sun.jndi.ldap.LdapURL;
> ....
> String url = "ldap://ad_jbs.ttt.net:389/xyz"; // bad input string containing _
> LdapURL ldapUrl = new LdapURL(url);
>
>
> java --add-opens java.naming/com.sun.jndi.ldap=ALL-UNNAMED LdapParseUrlTest
> Exception in thread "main" javax.naming.NamingException: Cannot parse url: ldap://ad_jbs.ttt.net:389/xyz [Root exception is java.net.MalformedURLException: unsupported authority: ad_jbs.ttt.net:389]
> at java.naming/com.sun.jndi.ldap.LdapURL.<init>(LdapURL.java:115)
> at LdapParseUrlTest.main(LdapParseUrlTest.java:9)
> Caused by: java.net.MalformedURLException: unsupported authority: ad_jbs.ttt.net:389
> at java.naming/com.sun.jndi.toolkit.url.Uri.parseCompat(Uri.java:367)
> at java.naming/com.sun.jndi.toolkit.url.Uri.parse(Uri.java:230)
> at java.naming/com.sun.jndi.toolkit.url.Uri.init(Uri.java:174)
> at java.naming/com.sun.jndi.ldap.LdapURL.<init>(LdapURL.java:105)
>
> I would like to add the host and port info to the exception (in the example it is host:port of URI:null:-1] ) so that it is directly visible that the input caused the construction of a URI
> with "special"/problematic host and port values.
This pull request has now been integrated.
Changeset: 33f34d54
Author: Matthias Baesken <mbaesken at openjdk.org>
URL: https://git.openjdk.org/jdk/commit/33f34d540e01db7e64da97d518e9dd88d014fb23
Stats: 2 lines in 1 file changed: 1 ins; 0 del; 1 mod
8288207: Enhance MalformedURLException in Uri.parseCompat
Reviewed-by: dfuchs, alanb
-------------
PR: https://git.openjdk.org/jdk/pull/9126
More information about the security-dev
mailing list