[
https://issues.apache.org/jira/browse/SOLR-18293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113723#comment-18113723
]
ASF subversion and git services commented on SOLR-18293:
--------------------------------------------------------
Commit 673af362f917604919ae13ff519de0b425e10207 in solr's branch
refs/heads/main from Jan Høydahl
[ https://gitbox.apache.org/repos/asf?p=solr.git;h=673af362f91 ]
SOLR-18293 Add changelog entry (#4896)
> AllowListUrlChecker uses inconsistent URL scheme detection compared to shard
> URL fetching
> -----------------------------------------------------------------------------------------
>
> Key: SOLR-18293
> URL: https://issues.apache.org/jira/browse/SOLR-18293
> Project: Solr
> Issue Type: Bug
> Reporter: Jan Høydahl
> Assignee: Jan Høydahl
> Priority: Major
> Labels: pull-request-available
> Fix For: 10.1, 9.11
>
> Attachments: SOLR-18293.patch
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> {{AllowListUrlChecker}} (the {{allowUrls}} / shard URL allow-list) derived a
> URL's host:port using its own protocol-detection regex, while the shard URL
> fetch path ({{{}HttpShardHandlerFactory#buildUrl{}}}) detects the scheme with
> {{{}URLUtil#hasScheme{}}}. Because the two used different rules for what
> counts as a scheme, URLs with non-standard scheme prefixes were parsed
> inconsistently between validation and fetching.
> For example, values such as {{{}s3://host:8983/solr{}}},
> {{HTTP://host:8983/solr}} and {{12345://host:8983/solr}} were
> accepted/normalized by the checker but would be interpreted differently when
> the URL was actually built and fetched.
> With the attached patch, {{parseHostPort}} now detects the scheme with
> {{URLUtil#hasScheme}} — the same helper the shard URL fetch uses — so both
> code paths interpret a given URL identically. URLs whose prefix is not a
> recognized scheme are now consistently rejected with
> {{{}MalformedURLException{}}}; ordinary {{host:port}} and
> {{http(s)://host:port}} entries are unaffected. This also simplifies code and
> removes some lines.
> Reported by Rajat Raghav (Xclow3n).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
