Introduce URL parser based on algorithm provided in Living URL standard #32513
Assignees
Labels
in: web
Issues in web modules (web, webmvc, webflux, websocket)
type: enhancement
A general enhancement
Milestone
Comments
poutsma
added
in: web
|
Due to security considerations, this is an issue that we'd like to handle ourselves, and as such it is not open for external contributions. |
poutsma
added a commit
that referenced
this issue
Apr 17, 2024
poutsma
added a commit
that referenced
this issue
Apr 18, 2024
poutsma
added a commit
that referenced
this issue
Apr 26, 2024
poutsma
added a commit
that referenced
this issue
May 2, 2024
poutsma
added a commit
that referenced
this issue
May 3, 2024
Improvements include: - Replace throwing exceptions with failure results in hot areas, - Verify digits of a string before passing it to Integer::parseInt - Lazily initialization of fields - Using LinkedList instead of ArrayList where size is not known beforehand See gh-32513
poutsma
added a commit
that referenced
this issue
May 3, 2024
- Consistent use of codePointAt instead of charAt. - Fix bug in domainToAscii See gh-32513
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
In the
UriComponentsBuilder::fromUriString, we use regular expressions to parse a given String into the various URI components (scheme, host, path, etc.). Regular expressions, by their very nature, are limited in what they can and cannot track. Because of these limitations, URL parsing has been a significant source of security reports recently. Additionally, the expressions have grown to be quite complicated over the years.The Living URL standard provides a robust algorithm for parsing URLs. We should introduce a URL parser based on that algorithm, instead of using regular expressions.
The text was updated successfully, but these errors were encountered: