Allow to configuredisableURIValidation for vertx http

[ia3andy]

Description

Currently vertx.disableURIValidation is a hidden flag used in the vertx http recorder:
https://github.com/quarkusio/quarkus/blob/main/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/VertxHttpRecorder.java#L117

We now have a use case for it in dev mode (Quinoa):
quarkiverse/quarkus-quinoa#591 (comment)

So we should provide a way to configure it from Quarkus config.

Implementation ideas

We could keep backward compat on this with the system props:
disabled if Boolean.getBoolean("vertx.disableURIValidation") or quarkus.http.disableURIValidation from config

[ia3andy]

This issue is related (and could be fixed at once): #37789

[geoand]

Due to how core VertxHttpRecorder.ACTUAL_ROOT really is, we can't really introduce a Quarkus specific property without either breaking a bunch of things or making the performance of the HTTP layer worse.
So I would go with just documenting that flag for Quinoa users

[cescoffier]

disableURIValidation is not exposed for a reason: you want to validate URI. It's an attack vector.

[ia3andy]

disableURIValidation is not exposed for a reason: you want to validate URI. It's an attack vector.

@cescoffier it's not entirely true

The Java implementation or URI seems to not be following the RFC.

Have a look to what OkHttp did on this topic: square/okhttp#1044

[cescoffier]

Hum, defining our own URI/URL class and following all the RFCs, that's looks lengthy and risky.

[ia3andy]

@cescoffier I agree, not sure what the best way forward.

As the current issue is with dev-mode, maybe we could have an option to disable it only in dev-mode?

[geoand]

Hum, defining our own URI/URL class and following all the RFCs, that's looks lengthy and risky.

That's what I said also, specifically that I personally would not develop or maintain such a thing :)

[cescoffier]

@ia3andy LEt me think a bit about it. We need to be absolutely sure we do not open an attack vector. Dev mode in a networked environment can be problematic (not sure about remote dev mode).

[cescoffier]

Too risky.