Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relax the validation of Location header when redirecting #5477

Merged
merged 6 commits into from
Mar 29, 2024

Commits on Mar 8, 2024

  1. Relax the validation of Location header when redirecting

    Reported by @ohadgur at https://discord.com/channels/1087271586832318494/1209914423494311948
    
    Motivation:
    
    If a client is configured to follow redirects with `followRedirects()`,
    the client will validate the value of `Location` header before sending a
    follow-up request to the given redirect location. `RedirectingClient`
    validates and resolves the target location using `URI.resolve()` which
    rejects poorly encoded `Location` header values such as:
    
    - `Location: /foo bar` (space should be percent-encoded)
    - `Location: /?${}` (`$`, `{` and `}` should be percent-encoded.)
    
    Modifications:
    
    - `RedirectingClient` now uses `RequestTarget.forClient()` to parse and
      normalize the target location so it is more tolerant to poorly encoded
      `Location` header values.
    - `RedirectingClient` now implements its own relative path resolution
      logic. See `RedirectingClient.resolveLocation()` for the detail.
    - Added `host` and `port` properties to `RequestTarget`.
    - Moved `DefaultRequestTarget.findAuthority()` to `ArmeriaHttpUtil` to
      reuse it in `RedirectingClient`.
    - Miscellaneous:
      - Fixed a potential bug where `RoutingContext.newPath()` creates a new
        `RequestTarget` whose `path` is `null`
    
    Result:
    
    - An Armeria client is now more tolerant to poorly encoded `Location`
      header values when following redirects.
    trustin committed Mar 8, 2024
    Configuration menu
    Copy the full SHA
    d6953c1 View commit details
    Browse the repository at this point in the history
  2. Fix test failures

    trustin committed Mar 8, 2024
    Configuration menu
    Copy the full SHA
    cb8693c View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    46b73f7 View commit details
    Browse the repository at this point in the history
  4. Maybe final touch

    trustin committed Mar 8, 2024
    Configuration menu
    Copy the full SHA
    7d883b9 View commit details
    Browse the repository at this point in the history
  5. Fixes

    trustin committed Mar 8, 2024
    Configuration menu
    Copy the full SHA
    ba55334 View commit details
    Browse the repository at this point in the history

Commits on Mar 18, 2024

  1. Update core/src/main/java/com/linecorp/armeria/client/RedirectingClie…

    …nt.java
    
    Co-authored-by: minux <songmw725@gmail.com>
    trustin and minwoox committed Mar 18, 2024
    Configuration menu
    Copy the full SHA
    68927bc View commit details
    Browse the repository at this point in the history