Reject non-URI-safe hosts in HostSpecifier#8459
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
aa13fce to
58f6a14
Compare
58f6a14 to
bf0b546
Compare
|
This is a case in which we might have a hard time finding the expertise to figure out what to do here. We have tests that expect both to be able to pass domains with underscores (seen in legacy Amazon S3 buckets, I'm reading) and to be able to pass non-ASCII characters (typically converted to Punycode automatically by browsers). We've also seen (non- |
|
Thanks, that makes sense. My intent was not to change the broader behavior of I agree that rejecting all non-ASCII domain names may be too broad if callers expect browser-like IDN handling. A narrower option could be to canonicalize IDNs through The underscore case seems harder because Which direction would you prefer for this PR: a narrower IDN canonicalization patch, documentation clarification, or keeping the stricter URI-host validation? |
This tightens
HostSpecifierso hosts accepted through the IP-literal and domain-name paths remain suitable for use as URI hosts.Changes:
InetAddresses.forStringfor non-ASCII input so non-ASCII digit IP literals are not accepted and canonicalized.Tests:
git diff --checkjavac/javaverification forguava/src/com/google/common/net/HostSpecifier.javajavac/javaverification forandroid/guava/src/com/google/common/net/HostSpecifier.java./mvnw -Dmaven.repo.local=/tmp/guava-m2 -pl guava-tests -am -Dtest=HostSpecifierTest testdid not complete locally because toolchain auto-install attempted to download Temurin JDK 26 and failed on a partial archive.