From f1e63f300884446821aba9956c1bce7f3848f660 Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Fri, 21 Oct 2011 17:24:05 +0100 Subject: [PATCH] SEC-1802: Add digits to valid URL scheme regex. --- .../java/org/springframework/security/web/util/UrlUtils.java | 2 +- .../org/springframework/security/web/util/UrlUtilsTests.java | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/util/UrlUtils.java b/web/src/main/java/org/springframework/security/web/util/UrlUtils.java index fb679e0f21..c4f40cf170 100644 --- a/web/src/main/java/org/springframework/security/web/util/UrlUtils.java +++ b/web/src/main/java/org/springframework/security/web/util/UrlUtils.java @@ -129,7 +129,7 @@ public final class UrlUtils { * Decides if a URL is absolute based on whether it contains a valid scheme name, as defined in RFC 1738. */ public static boolean isAbsoluteUrl(String url) { - final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z.+-]+://.*", Pattern.CASE_INSENSITIVE); + final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z0-9.+-]+://.*", Pattern.CASE_INSENSITIVE); return ABSOLUTE_URL.matcher(url).matches(); } diff --git a/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java b/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java index 4d521bc99e..aa4da44958 100644 --- a/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java +++ b/web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java @@ -13,6 +13,7 @@ public class UrlUtilsTests { @Test public void absoluteUrlsAreMatchedAsAbsolute() throws Exception { assertTrue(UrlUtils.isAbsoluteUrl("http://something/")); + assertTrue(UrlUtils.isAbsoluteUrl("http1://something/")); assertTrue(UrlUtils.isAbsoluteUrl("HTTP://something/")); assertTrue(UrlUtils.isAbsoluteUrl("https://something/")); assertTrue(UrlUtils.isAbsoluteUrl("a://something/"));