Top Description Inners Fields Constructors Methods
org.eclipse.jetty.http

public final Class UriCompliance

extends Object
implements Mode
Class Inheritance
All Implemented Interfaces
org.eclipse.jetty.http.ComplianceViolation.Mode
Imports
java.util.Collections, .EnumSet, .List, .Objects, .Set, java.util.concurrent.atomic.AtomicInteger, org.slf4j.Logger, .LoggerFactory
URI compliance modes for Jetty request handling. A Compliance mode consists of a set of Violations which are allowed when the mode is enabled.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static enum
UriCompliance.Violation

These are URI compliance "violations", which may be allowed by the compliance mode.

Field Summary

Modifier and TypeField and Description
private static final AtomicInteger
__custom

private final Set<UriCompliance.Violation>
_allowed

private final String
_name

public static final Set<UriCompliance.Violation>
AMBIGUOUS_VIOLATIONS

public static final UriCompliance
DEFAULT

The default compliance mode allows no violations from RFC3986 and is equivalent to RFC3986 compliance.

private static final List<UriCompliance>
KNOWN_MODES

public static final UriCompliance
LEGACY

LEGACY compliance mode that models Jetty-9.4 behavior by allowing Violation#AMBIGUOUS_PATH_SEGMENT, Violation#AMBIGUOUS_EMPTY_SEGMENT, Violation#AMBIGUOUS_PATH_SEPARATOR, Violation#AMBIGUOUS_PATH_ENCODING and Violation#UTF16_ENCODINGS.

private static final Logger
LOG

public static final Set<UriCompliance.Violation>
NO_VIOLATION

public static final UriCompliance
RFC3986

Compliance mode that exactly follows RFC3986, excluding all URI Violations.

public static final UriCompliance
UNAMBIGUOUS

Compliance mode that allows all unambiguous violations.

public static final UriCompliance
UNSAFE

Compliance mode that allows all URI Violations, including allowing ambiguous paths in non-canonical form.

Constructor Summary

AccessConstructor and Description
public
UriCompliance(String name, Set<UriCompliance.Violation> violations)

Method Summary

Modifier and TypeMethod and Description
public boolean
allows(ComplianceViolation
The ComplianceViolation to test
violation)

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.allows.

public static String
checkUriCompliance(UriCompliance compliance, HttpURI uri, ComplianceViolation.Listener listener)

private static Set<UriCompliance.Violation>
copyOf(UriCompliance.Violation[] violations)

private static Set<UriCompliance.Violation>
copyOf(Set<UriCompliance.Violation> violations)

public static UriCompliance

Returns:

the compliance from the string spec
from(Set<UriCompliance.Violation>
A string of violations to allow:
violations)

Create compliance set from a set of allowed Violations.

public static UriCompliance

Returns:

the UriCompliance instance derived from the string description
from(String
A string describing the compliance
spec)

Create compliance set from string.

public Set<UriCompliance.Violation>

Returns:

The immutable set of Violations allowed by this compliance mode.
getAllowed()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getAllowed.

Get the set of Violations allowed by this compliance mode.
public Set<UriCompliance.Violation>
getKnown()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getKnown.

public String
getName()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getName.

public static boolean
isAmbiguous(Set<UriCompliance.Violation> violations)

public String
toString()

Overrides java.lang.Object.toString.

Returns a string representation of the object.
public static UriCompliance
valueOf(String name)

public UriCompliance

Returns:

A new UriCompliance mode.
with(String
The name of the new mode
name, UriCompliance.Violation...
The violations to include
violations)

Create a new UriCompliance mode that includes the passed Violations.

public UriCompliance

Returns:

A new UriCompliance mode.
without(String
The name of the new mode
name, UriCompliance.Violation...
The violations to exclude
violations)

Create a new UriCompliance mode that excludes the passed Violations.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAllwaitwaitwait

Field Detail

__customback to summary
private static final AtomicInteger __custom
_allowedback to summary
private final Set<UriCompliance.Violation> _allowed
_nameback to summary
private final String _name
AMBIGUOUS_VIOLATIONSback to summary
public static final Set<UriCompliance.Violation> AMBIGUOUS_VIOLATIONS
DEFAULTback to summary
public static final UriCompliance DEFAULT

The default compliance mode allows no violations from RFC3986 and is equivalent to RFC3986 compliance.

KNOWN_MODESback to summary
private static final List<UriCompliance> KNOWN_MODES
LEGACYback to summary
public static final UriCompliance LEGACY

LEGACY compliance mode that models Jetty-9.4 behavior by allowing Violation#AMBIGUOUS_PATH_SEGMENT, Violation#AMBIGUOUS_EMPTY_SEGMENT, Violation#AMBIGUOUS_PATH_SEPARATOR, Violation#AMBIGUOUS_PATH_ENCODING and Violation#UTF16_ENCODINGS.

LOGback to summary
private static final Logger LOG
NO_VIOLATIONback to summary
public static final Set<UriCompliance.Violation> NO_VIOLATION
RFC3986back to summary
public static final UriCompliance RFC3986

Compliance mode that exactly follows RFC3986, excluding all URI Violations.

UNAMBIGUOUSback to summary
public static final UriCompliance UNAMBIGUOUS

Compliance mode that allows all unambiguous violations.

UNSAFEback to summary
public static final UriCompliance UNSAFE

Compliance mode that allows all URI Violations, including allowing ambiguous paths in non-canonical form.

Constructor Detail

UriComplianceback to summary
public UriCompliance(String name, Set<UriCompliance.Violation> violations)

Method Detail

allowsback to summary
public boolean allows(ComplianceViolation violation)

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.allows.

Parameters
violation:ComplianceViolation

Doc from org.eclipse.jetty.http.ComplianceViolation.Mode.allows.

The ComplianceViolation to test

Returns:boolean

Doc from org.eclipse.jetty.http.ComplianceViolation.Mode.allows.

true iff the violation is allowed by this mode.

Annotations
@Override
checkUriComplianceback to summary
public static String checkUriCompliance(UriCompliance compliance, HttpURI uri, ComplianceViolation.Listener listener)
copyOfback to summary
private static Set<UriCompliance.Violation> copyOf(UriCompliance.Violation[] violations)
copyOfback to summary
private static Set<UriCompliance.Violation> copyOf(Set<UriCompliance.Violation> violations)
fromback to summary
public static UriCompliance from(Set<UriCompliance.Violation> violations)

Create compliance set from a set of allowed Violations.

Parameters
violations:Set<UriCompliance.Violation>

A string of violations to allow:

Returns:UriCompliance

the compliance from the string spec

fromback to summary
public static UriCompliance from(String spec)

Create compliance set from string.

Format: <BASE>[,[-]<violation>]...

BASE is one of:

0
No Violations
*
All Violations
<name>
The name of a static instance of UriCompliance (e.g. UriCompliance#RFC3986).

The remainder of the list can contain then names of Violations to include them in the mode, or prefixed with a '-' to exclude them from the mode. Examples are:

0,AMBIGUOUS_PATH_PARAMETER
Only allow Violation#AMBIGUOUS_PATH_PARAMETER
*,-AMBIGUOUS_PATH_PARAMETER
Only all except Violation#AMBIGUOUS_PATH_PARAMETER
RFC3986,AMBIGUOUS_PATH_PARAMETER
Same as RFC3986 plus Violation#AMBIGUOUS_PATH_PARAMETER
Parameters
spec:String

A string describing the compliance

Returns:UriCompliance

the UriCompliance instance derived from the string description

getAllowedback to summary
public Set<UriCompliance.Violation> getAllowed()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getAllowed.

Get the set of Violations allowed by this compliance mode.

Returns:Set<UriCompliance.Violation>

The immutable set of Violations allowed by this compliance mode.

Annotations
@Override
getKnownback to summary
public Set<UriCompliance.Violation> getKnown()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getKnown.

Returns:Set<UriCompliance.Violation>

Doc from org.eclipse.jetty.http.ComplianceViolation.Mode.getKnown.

The immutable set of all known violations for this mode.

Annotations
@Override
getNameback to summary
public String getName()

Implements org.eclipse.jetty.http.ComplianceViolation.Mode.getName.

Returns:String

Doc from org.eclipse.jetty.http.ComplianceViolation.Mode.getName.

The name of the compliance violation mode.

Annotations
@Override
isAmbiguousback to summary
public static boolean isAmbiguous(Set<UriCompliance.Violation> violations)
toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Doc from java.lang.Object.toString.

Returns a string representation of the object.

Returns:String

a string representation of the object.

Annotations
@Override
valueOfback to summary
public static UriCompliance valueOf(String name)
withback to summary
public UriCompliance with(String name, UriCompliance.Violation... violations)

Create a new UriCompliance mode that includes the passed Violations.

Parameters
name:String

The name of the new mode

violations:UriCompliance.Violation[]

The violations to include

Returns:UriCompliance

A new UriCompliance mode.

withoutback to summary
public UriCompliance without(String name, UriCompliance.Violation... violations)

Create a new UriCompliance mode that excludes the passed Violations.

Parameters
name:String

The name of the new mode

violations:UriCompliance.Violation[]

The violations to exclude

Returns:UriCompliance

A new UriCompliance mode.

org.eclipse.jetty.http back to summary

public final Enum UriCompliance.Violation

extends Enum<UriCompliance.Violation>
implements ComplianceViolation
Class Inheritance
All Implemented Interfaces
org.eclipse.jetty.http.ComplianceViolation
These are URI compliance "violations", which may be allowed by the compliance mode. These are actual violations of the RFC, as they represent additional requirements in excess of the strict compliance of RFC 3986. A compliance mode that contains one or more of these Violations, allows request to violate the corresponding additional requirement.

Field Summary

Modifier and TypeField and Description
private final String
_description

private final String
_url

public static final UriCompliance.Violation
AMBIGUOUS_EMPTY_SEGMENT

Allow ambiguous empty segments e.g. //.

public static final UriCompliance.Violation
AMBIGUOUS_PATH_ENCODING

Allow ambiguous path encoding within a URI segment e.g. /%2557EB-INF.

public static final UriCompliance.Violation
AMBIGUOUS_PATH_PARAMETER

Allow ambiguous path parameters within a URI segment e.g. /foo/..;/bar or /foo/%2e%2e;param/bar.

public static final UriCompliance.Violation
AMBIGUOUS_PATH_SEGMENT

Allow ambiguous path segments e.g. /foo/%2e%2e/bar.

public static final UriCompliance.Violation
AMBIGUOUS_PATH_SEPARATOR

Allow ambiguous path separator within a URI segment e.g. /foo/b%2fr When allowing this Violation, the application developer/deployer must be aware that the decoded URI path is ambiguous and that it is not possible to distinguish in the decoded path a real path separator versus an encoded separator character.

public static final UriCompliance.Violation
BAD_UTF8_ENCODING

Allow Bad UTF-8 encodings to be substituted by the replacement character.

public static final UriCompliance.Violation
UTF16_ENCODINGS

Allow UTF-16 encoding eg /foo%u2192bar.

Constructor Summary

AccessConstructor and Description
private
Violation(String url, String description)

Method Summary

Modifier and TypeMethod and Description
public String
getDescription()

Implements org.eclipse.jetty.http.ComplianceViolation.getDescription.

public String
getName()

Implements org.eclipse.jetty.http.ComplianceViolation.getName.

public String
getURL()

Implements org.eclipse.jetty.http.ComplianceViolation.getURL.

public static UriCompliance.Violation
valueOf(String name)

public static UriCompliance.Violation[]
values()

Inherited from java.lang.Enum:
clonecompareTodescribeConstableequalsfinalizegetDeclaringClasshashCodenameordinaltoStringvalueOf

Field Detail

_descriptionback to summary
private final String _description
_urlback to summary
private final String _url
AMBIGUOUS_EMPTY_SEGMENTback to summary
public static final UriCompliance.Violation AMBIGUOUS_EMPTY_SEGMENT

Allow ambiguous empty segments e.g. //. When allowing this Violation, the application developer/deployer must ensure that the application behaves as desired when it receives a URI path containing //. Specifically, any URI pattern matching for security concerns needs to be carefully audited.

AMBIGUOUS_PATH_ENCODINGback to summary
public static final UriCompliance.Violation AMBIGUOUS_PATH_ENCODING

Allow ambiguous path encoding within a URI segment e.g. /%2557EB-INF. When allowing this Violation, the deployer must ensure that the decoded URI path is not passed to any API that may inadvertently further decode any percent encoded characters. Any resulting `%` character in the decoded path should be treated as a literal character.

AMBIGUOUS_PATH_PARAMETERback to summary
public static final UriCompliance.Violation AMBIGUOUS_PATH_PARAMETER

Allow ambiguous path parameters within a URI segment e.g. /foo/..;/bar or /foo/%2e%2e;param/bar. Since a dot or double dot segment with a parameter will not be normalized, then when allowing this Violation, the application developer/deployer must ensure that the decoded URI path is not passed to any API that may inadvertently normalize dot or double dot segments.

AMBIGUOUS_PATH_SEGMENTback to summary
public static final UriCompliance.Violation AMBIGUOUS_PATH_SEGMENT

Allow ambiguous path segments e.g. /foo/%2e%2e/bar. When allowing this Violation, the application developer/deployer must ensure that the decoded URI path is not passed to any API that may inadvertently normalize dot or double dot segments. Any resulting '.' characters in the decoded path should be treated as literal characters.

AMBIGUOUS_PATH_SEPARATORback to summary
public static final UriCompliance.Violation AMBIGUOUS_PATH_SEPARATOR

Allow ambiguous path separator within a URI segment e.g. /foo/b%2fr When allowing this Violation, the application developer/deployer must be aware that the decoded URI path is ambiguous and that it is not possible to distinguish in the decoded path a real path separator versus an encoded separator character. Any URI matching based on decoded segments may be affected by this ambiguity. It is highly recommended that applications using this violation work only with encoded URI paths. Some APIs that return decoded paths may throw an exception rather than return such an ambiguous path.

BAD_UTF8_ENCODINGback to summary
public static final UriCompliance.Violation BAD_UTF8_ENCODING

Allow Bad UTF-8 encodings to be substituted by the replacement character.

UTF16_ENCODINGSback to summary
public static final UriCompliance.Violation UTF16_ENCODINGS

Allow UTF-16 encoding eg /foo%u2192bar.

Constructor Detail

Violationback to summary
private Violation(String url, String description)

Method Detail

getDescriptionback to summary
public String getDescription()

Implements org.eclipse.jetty.http.ComplianceViolation.getDescription.

Returns:String

Doc from org.eclipse.jetty.http.ComplianceViolation.getDescription.

A short description of the violation.

Annotations
@Override
getNameback to summary
public String getName()

Implements org.eclipse.jetty.http.ComplianceViolation.getName.

Returns:String

Doc from org.eclipse.jetty.http.ComplianceViolation.getName.

The name of the violation.

Annotations
@Override
getURLback to summary
public String getURL()

Implements org.eclipse.jetty.http.ComplianceViolation.getURL.

Returns:String

Doc from org.eclipse.jetty.http.ComplianceViolation.getURL.

A URL to the specification that provides more information regarding the requirement that may be violated.

Annotations
@Override
valueOfback to summary
public static UriCompliance.Violation valueOf(String name)
valuesback to summary
public static UriCompliance.Violation[] values()