Function to get the redirect URL from the Location header is invalid

[linkdd]

What is the current bug behavior?

When doing a redirection, hurl use the Location header, which can either be a relative URL or an absolute URL.

However the function to compute the redirect URL is wrong, it assumes only strings starting with / are relative URLs.

Steps to reproduce

A GET / request to an OpenObserve instance returns a response with status code 307 and Location: ./web/. Hurl catches this as an "absolute URL" and then fails to resolve the domain name . (obviously).

But we could imagine other cases:

• a GET /foo could return a Location: ../bar
• a GET / (via http) could return a Location: https://... (why not ftp://, or gopher://, those are valid URLs as well)

The Location URL could also be //hostname/path (scheme relative URL).

What is the expected correct behavior?

If we take the initial absolute URL of the request, and join it with the value of the Location header, we should get the absolute redirect URL

Execution context

• Hurl Version (hurl --version): 4.3.0

Possible fixes

Related function:

hurl/packages/hurl/src/http/client.rs

Lines 773 to 780 in 9ec4d06

	/// Returns the redirect url.
	fn get_redirect_url(location: &str, base_url: &str) -> String {
	if location.starts_with('/') {
	format!("{base_url}{location}")
	} else {
	location.to_string()
	}
	}

Example of using the crate url to join the Location header:

https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=89982618796837fd896caa33eb45d1bb

[jcamiel]

Thanks a lot for the detailed report @linkdd the current code to deal with URL redirections was overly naive!

We've improved it with a proper Url struct (a wrapper on url crate), your snippets has help a lot!
Would you be kind to test the new version once the PR has been merged (if you can of course)?
Thanks,

(a small note: I've keep some logic on rejecting other scheme than http/https. I'll discuss with the others maintainers to see if we keep it)

[linkdd]

Sorry, I was on vacation :)

I just tested, works well, thank you!