Package org.eclipse.jetty.http

Class UriCompliance

java.lang.Object

org.eclipse.jetty.http.UriCompliance

All Implemented Interfaces:

ComplianceViolation.Mode

public final class UriCompliance
extends Object
implements ComplianceViolation.Mode

URI compliance modes for Jetty request handling. A Compliance mode consists of a set of UriCompliance.Violations which are allowed when the mode is enabled.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	UriCompliance.Violation	These are URI compliance "violations", which may be allowed by the compliance mode.

Field Summary

Fields

Modifier and Type	Field	Description
static final UriCompliance	DEFAULT	The default compliance mode that extends RFC3986 compliance with additional violations to avoid most ambiguous URIs.
static final UriCompliance	LEGACY	LEGACY compliance mode that models Jetty-9.4 behavior by allowing UriCompliance.Violation.AMBIGUOUS_PATH_SEGMENT, UriCompliance.Violation.AMBIGUOUS_EMPTY_SEGMENT, UriCompliance.Violation.AMBIGUOUS_PATH_SEPARATOR, UriCompliance.Violation.AMBIGUOUS_PATH_ENCODING and UriCompliance.Violation.UTF16_ENCODINGS
protected static final org.slf4j.Logger	LOG
static final UriCompliance	RFC3986	Compliance mode that exactly follows RFC3986, including allowing all additional ambiguous URI Violations.
static final UriCompliance	RFC3986_UNAMBIGUOUS	Compliance mode that follows RFC3986 plus it does not allow any ambiguous URI UriCompliance.Violations.
static final UriCompliance	SAFE	Deprecated. equivalent to DEFAULT
static final UriCompliance	STRICT	Deprecated. equivalent to RFC3986
static final UriCompliance	UNSAFE	Compliance mode that allows all URI Violations, including allowing ambiguous paths in non canonicalized form.

Constructor Summary

Constructors

Constructor	Description
UriCompliance(String name, Set<UriCompliance.Violation> violations)

Method Summary

Modifier and Type	Method	Description
boolean	allows(ComplianceViolation violation)
static String	checkUriCompliance(UriCompliance compliance, HttpURI uri)
static UriCompliance	from(String spec)	Create compliance set from string.
static UriCompliance	from(Set<UriCompliance.Violation> violations)	Create compliance set from a set of allowed Violations.
Set<UriCompliance.Violation>	getAllowed()	Get the set of UriCompliance.Violations allowed by this compliance mode.
Set<UriCompliance.Violation>	getKnown()
String	getName()
String	toString()
static UriCompliance	valueOf(String name)
UriCompliance	with(String name, UriCompliance.Violation... violations)	Create a new UriCompliance mode that includes the passed UriCompliance.Violations.
UriCompliance	without(String name, UriCompliance.Violation... violations)	Create a new UriCompliance mode that excludes the passed UriCompliance.Violations.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Details

LOG

protected static final org.slf4j.Logger LOG

DEFAULT

public static final UriCompliance DEFAULT

The default compliance mode that extends RFC3986 compliance with additional violations to avoid most ambiguous URIs. This mode does allow UriCompliance.Violation.AMBIGUOUS_PATH_SEPARATOR, UriCompliance.Violation.AMBIGUOUS_PATH_ENCODING, but disallows all out UriCompliance.Violations.

LEGACY

public static final UriCompliance LEGACY

LEGACY compliance mode that models Jetty-9.4 behavior by allowing UriCompliance.Violation.AMBIGUOUS_PATH_SEGMENT, UriCompliance.Violation.AMBIGUOUS_EMPTY_SEGMENT, UriCompliance.Violation.AMBIGUOUS_PATH_SEPARATOR, UriCompliance.Violation.AMBIGUOUS_PATH_ENCODING and UriCompliance.Violation.UTF16_ENCODINGS

RFC3986

public static final UriCompliance RFC3986

Compliance mode that exactly follows RFC3986, including allowing all additional ambiguous URI Violations.

RFC3986_UNAMBIGUOUS

public static final UriCompliance RFC3986_UNAMBIGUOUS

Compliance mode that follows RFC3986 plus it does not allow any ambiguous URI UriCompliance.Violations.

UNSAFE

public static final UriCompliance UNSAFE

Compliance mode that allows all URI Violations, including allowing ambiguous paths in non canonicalized form.

SAFE

@Deprecated
public static final UriCompliance SAFE

Deprecated.

equivalent to DEFAULT

STRICT

@Deprecated
public static final UriCompliance STRICT

Deprecated.

equivalent to RFC3986

Constructor Details

UriCompliance

public UriCompliance(String name,
 Set<UriCompliance.Violation> violations)

Method Details

valueOf

public static UriCompliance valueOf(String name)

from

public static UriCompliance from(Set<UriCompliance.Violation> violations)

Create compliance set from a set of allowed Violations.

Parameters:

violations - A string of violations to allow:

Returns:

the compliance from the string spec

from

public static UriCompliance from(String spec)

Create compliance set from string.

Format: <BASE>[,[-]<violation>]...

BASE is one of:

0

No UriCompliance.Violations

*

All UriCompliance.Violations

<name>

The name of a static instance of UriCompliance (e.g. RFC3986).

The remainder of the list can contain then names of UriCompliance.Violations to include them in the mode, or prefixed with a '-' to exclude them from the mode. Examples are:

0,AMBIGUOUS_PATH_PARAMETER

Only allow UriCompliance.Violation.AMBIGUOUS_PATH_PARAMETER

*,-AMBIGUOUS_PATH_PARAMETER

Only all except UriCompliance.Violation.AMBIGUOUS_PATH_PARAMETER

RFC3986,AMBIGUOUS_PATH_PARAMETER

Same as RFC3986 plus UriCompliance.Violation.AMBIGUOUS_PATH_PARAMETER

Parameters:

spec - A string describing the compliance

Returns:

the UriCompliance instance derived from the string description

allows

public boolean allows(ComplianceViolation violation)

Specified by:

allows in interface ComplianceViolation.Mode

Parameters:

violation - The ComplianceViolation to test

Returns:

true iff the violation is allowed by this mode.

getName

public String getName()

Specified by:

getName in interface ComplianceViolation.Mode

Returns:

The name of the compliance violation mode.

getAllowed

public Set<UriCompliance.Violation> getAllowed()

Get the set of UriCompliance.Violations allowed by this compliance mode.

Specified by:

getAllowed in interface ComplianceViolation.Mode

Returns:

The immutable set of UriCompliance.Violations allowed by this compliance mode.

getKnown

public Set<UriCompliance.Violation> getKnown()

Specified by:

getKnown in interface ComplianceViolation.Mode

Returns:

The immutable set of all known violations for this mode.

with

public UriCompliance with(String name,
 UriCompliance.Violation... violations)

Create a new UriCompliance mode that includes the passed UriCompliance.Violations.

Parameters:

name - The name of the new mode

violations - The violations to include

Returns:

A new UriCompliance mode.

without

public UriCompliance without(String name,
 UriCompliance.Violation... violations)

Create a new UriCompliance mode that excludes the passed UriCompliance.Violations.

Parameters:

name - The name of the new mode

violations - The violations to exclude

Returns:

A new UriCompliance mode.

toString

public String toString()

Overrides:

toString in class Object

checkUriCompliance

public static String checkUriCompliance(UriCompliance compliance,
 HttpURI uri)