IPv6 host names are not checked for brackets when using HttpRequest with ServletCall

[Maia-Everett]

ServletCall.getHostDomain() simply returns the result of getServerName() from the HttpServletRequest without surrounding it with brackets.

Unfortunately, in combination with the HttpClient constructor, this results in cases where hostRef contains a malformed URL, since the hostRef URL is assembled by using StringBuilder (why?!) with everything concatenated without escaping.

This causes issues with Jetty 9 servlets and ServletAdapter, since HttpServletRequest.getServerName() there returns IPv6 addresses without any escaping.

For example, when accessing

http://[::1]:8888/api-path

references in HttpClient are actually set to

http://::1:8888/api-path

and later attempts to parse the URL fail with:

Can't parse hostPort : [hostRef,requestUri]=[null,http://::1:8888/api-path]

This can be fixed by changing either HttpClient or ServletCall to check for unbracketed IPv6 addresses and bracket them as necessary. I'm not sure which is the right way (the right right way, of course, being using java.net.URI for assembling URLs, and not that StringBuilder hack, but I assume you had reasons to do it this way). I'll make a pull request with ServletCall changed.

[thboileau]

Hello @lucidfox could you point us to the StringBuilder hack? This could be the opportunity to consider the usage of JDK classes.
When you are talking about "HttpClient", are you talking about the Jetty client?

[Maia-Everett]

Sorry, my bad. I meant HttpRequest, not HttpClient.

This is the StringBuilder use in question:

https://github.com/restlet/restlet-framework-java/blob/master/modules/org.restlet/src/org/restlet/engine/adapter/HttpRequest.java#L158

[jlouvel]

Here is a discussion on StringBuilder versus +
http://stackoverflow.com/questions/18453458/string-builder-vs-string-concatenation

[Maia-Everett]

The problem is not specifically with StringBuilder, but with building a URL by concatenating strings, without performing proper escaping for e.g. the host name if it's an unbracketed IPv6 address. java.net.URI exists for this purpose.

[jlouvel]

I see your point. Let's fix the issue as you suggested (JCA pending I think). We should also check our org.restlet.data.Reference class which is similar in purpose to java.net.URI.