diff --git a/web/src/main/java/org/springframework/security/web/util/UrlUtils.java b/web/src/main/java/org/springframework/security/web/util/UrlUtils.java index fb679e0f21..c4f40cf170 100644 --- a/web/src/main/java/org/springframework/security/web/util/UrlUtils.java +++ b/web/src/main/java/org/springframework/security/web/util/UrlUtils.java @@ -129,7 +129,7 @@ public final class UrlUtils { * Decides if a URL is absolute based on whether it contains a valid scheme name, as defined in RFC 1738. */ public static boolean isAbsoluteUrl(String url) { - final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z.+-]+://.*", Pattern.CASE_INSENSITIVE); + final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z0-9.+-]+://.*", Pattern.CASE_INSENSITIVE); return ABSOLUTE_URL.matcher(url).matches(); } diff --git a/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java b/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java index 4d521bc99e..aa4da44958 100644 --- a/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java +++ b/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java @@ -13,6 +13,7 @@ public class UrlUtilsTests { @Test public void absoluteUrlsAreMatchedAsAbsolute() throws Exception { assertTrue(UrlUtils.isAbsoluteUrl("http://something/")); + assertTrue(UrlUtils.isAbsoluteUrl("http1://something/")); assertTrue(UrlUtils.isAbsoluteUrl("HTTP://something/")); assertTrue(UrlUtils.isAbsoluteUrl("https://something/")); assertTrue(UrlUtils.isAbsoluteUrl("a://something/"));