4.x: Empty path

http/http/src/main/java/io/helidon/http/DirectHandler.java

@@ -89,7 +89,7 @@ default TransportResponse handle(TransportRequest request,
                 return handle(request, eventType, defaultStatus, responseHeaders, thrown.getMessage());
             } else {
                 if (logger != null) {
-                    logger.log(Level.ERROR, thrown);
+                    logger.log(Level.DEBUG, thrown);
                 }
                 return handle(request, eventType, defaultStatus, responseHeaders,
                         "Bad request, see server log for more information");

microprofile/server/src/test/resources/logging.properties

@@ -0,0 +1,24 @@
+#
+# Copyright (c) 2023 Oracle and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+handlers = java.util.logging.ConsoleHandler
+
+java.util.logging.ConsoleHandler.level = FINEST
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+java.util.logging.SimpleFormatter.format = [%1$tc] %4$s: %2$s - %5$s %6$s%n
+
+.level = INFO
+io.helidon.config.level = FINEST

webserver/testing/junit5/junit5/src/main/java/io/helidon/webserver/testing/junit5/HelidonServerJunitExtension.java

@@ -89,13 +89,13 @@ public void beforeAll(ExtensionContext context) {
         extensions.forEach(it -> it.beforeAll(context));
         extensions.forEach(it -> it.updateServerBuilder(builder));
 
-        setupServer(builder);
-        addRouting(builder);
-
         // port will be random
         builder.port(0)
                 .shutdownHook(false);
 
+        setupServer(builder);
+        addRouting(builder);
+
         server = builder.build().start();
         if (server.hasTls()) {
             uris.put(DEFAULT_SOCKET_NAME, URI.create("https://localhost:" + server.port() + "/"));

webserver/tests/webserver/src/test/java/io/helidon/webserver/tests/PathTest.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2023 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.webserver.tests;
+
+import java.io.IOException;
+import java.net.URI;
+
+import io.helidon.common.testing.http.junit5.SocketHttpClient;
+import io.helidon.webserver.testing.junit5.ServerTest;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.startsWith;
+
+@ServerTest
+class PathTest {
+
+    private final SocketHttpClient client;
+    private final URI uri;
+
+    public PathTest(SocketHttpClient client, URI uri) {
+        this.client = client;
+        this.uri = uri;
+    }
+
+    /**
+     * RFC 7230 5.3.1.  origin-form
+     *
+     * If the target URI's path component is
+     * empty, the client MUST send "/" as the path within the origin-form of
+     * request-target.
+     */
+    @Test
+    void emptyPath() throws Exception {
+        String received = client
+                .manualRequest(
+                        """
+                                GET   HTTP/1.1
+                                Host: localhost:%d
+                                Accept: */*
+                                Connection: keep-alive
+
+                                """, uri.getPort())
+                .receive();
+        assertThat(received, startsWith("HTTP/1.1 400 Bad Request"));
+    }
+
+    @ParameterizedTest(name = "{index} GET {0} HTTP/1.1")
+    @ValueSource(strings = {"\r", "\t", "\t\t\t", "<", "     "})
+    void illegalPath(String param) throws IOException {
+        String received = client
+                .manualRequest(
+                        """
+                                GET %s HTTP/1.1
+                                Host: localhost:%d
+                                Accept: */*
+                                Connection: keep-alive
+
+                                """, param, uri.getPort())
+                .receive();
+        assertThat(received, startsWith("HTTP/1.1 400 Bad Request"));
+    }
+}

webserver/webserver/src/main/java/io/helidon/webserver/http1/Http1Prologue.java

@@ -131,6 +131,9 @@ private HttpPrologue doRead() {
             if (eol == maxLen) {
                 throw badRequest("Prologue size exceeded", method.text(), path, "", "");
             }
+            if (path.isBlank()) {
+                throw badRequest("Path can't be empty", method.text(), path, "", "");
+            }
             protocol = reader.readAsciiString(eol);
             reader.skip(2); // \r\n
         } catch (DataReader.IncorrectNewLineException e) {