Issue #6447 - Deprecate support for UTF16 encoding in URIs (#6467)

- Merge from PR #6457. - Also brought some other ComplianceModes back to disable ambiguous empty segments, and ambiguous encodings. Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
jetty · Jun 24, 2021 · a3effb1 · a3effb1
1 parent 97b52e4
commit a3effb1
Show file tree

Hide file tree

Showing 9 changed files with 787 additions and 418 deletions.
diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCompliance.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCompliance.java
@@ -132,15 +132,21 @@ static EnumSet<HttpComplianceSection> sectionsBySpec(String spec)
                     HttpComplianceSection.NO_FIELD_FOLDING,
                     HttpComplianceSection.NO_HTTP_0_9,
                     HttpComplianceSection.NO_AMBIGUOUS_PATH_SEGMENTS,
-                    HttpComplianceSection.NO_AMBIGUOUS_PATH_SEPARATORS));
+                    HttpComplianceSection.NO_AMBIGUOUS_PATH_SEPARATORS,
+                    HttpComplianceSection.NO_UTF16_ENCODINGS,
+                    HttpComplianceSection.NO_AMBIGUOUS_EMPTY_SEGMENT,
+                    HttpComplianceSection.NO_AMBIGUOUS_PATH_ENCODING));
                 break;
 
             case "*":
             case "RFC7230":
                 i++;
                 sections = EnumSet.complementOf(EnumSet.of(
                     HttpComplianceSection.NO_AMBIGUOUS_PATH_SEGMENTS,
-                    HttpComplianceSection.NO_AMBIGUOUS_PATH_SEPARATORS));
+                    HttpComplianceSection.NO_AMBIGUOUS_PATH_SEPARATORS,
+                    HttpComplianceSection.NO_UTF16_ENCODINGS,
+                    HttpComplianceSection.NO_AMBIGUOUS_EMPTY_SEGMENT,
+                    HttpComplianceSection.NO_AMBIGUOUS_PATH_ENCODING));
                 break;
 
             default:

diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpComplianceSection.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpComplianceSection.java
@@ -34,7 +34,10 @@ public enum HttpComplianceSection
     MULTIPLE_CONTENT_LENGTHS("https://tools.ietf.org/html/rfc7230#section-3.3.1", "Multiple Content-Lengths"),
     NO_AMBIGUOUS_PATH_SEGMENTS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path segments"),
     NO_AMBIGUOUS_PATH_SEPARATORS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path separators"),
-    NO_AMBIGUOUS_PATH_PARAMETERS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path parameters");
+    NO_AMBIGUOUS_PATH_PARAMETERS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path parameters"),
+    NO_UTF16_ENCODINGS("https://www.w3.org/International/iri-edit/draft-duerst-iri.html#anchor29", "UTF16 encoding"),
+    NO_AMBIGUOUS_EMPTY_SEGMENT("https://tools.ietf.org/html/rfc3986#section-3.3", "Ambiguous URI empty segment"),
+    NO_AMBIGUOUS_PATH_ENCODING("https://tools.ietf.org/html/rfc3986#section-3.3", "Ambiguous URI path encoding");
 
     final String url;
     final String description;