[GitHub] [knox] moresandeep commented on a change in pull request #514: KNOX-2655 - Disallow Userinfo in KnoxSSO originalURL Query Param

[GitBox <gi...@apache.org>]

moresandeep commented on a change in pull request #514:
URL: https://github.com/apache/knox/pull/514#discussion_r740970651



##########
File path: gateway-util-common/src/main/java/org/apache/knox/gateway/util/Urls.java
##########
@@ -71,6 +71,16 @@ public static int dotOccurrences(String domain) {
     return domain.length() - domain.replace(".", "").length();
   }
 
+  /**
+   * Does the provided URL contain UserInfo
+   * @param url
+   * @return true if a URL contains userInfo else false
+   * @throws MalformedURLException
+   */
+  public static boolean containsUserInfo(String url) throws MalformedURLException {
+    return (new URL(url).getUserInfo() != null);

Review comment:
       Do we need to worry about encoded @ i.e `%40` ?

##########
File path: gateway-util-common/src/test/java/org/apache/knox/gateway/util/UrlsTest.java
##########
@@ -94,4 +94,9 @@ public void testURLEncoding() throws Exception {
     assertEquals( "%3F", Urls.encode( "?" ) );
   }
 
+  @Test
+  public void testContainsUserInfo() throws Exception {
+    assertEquals(true, Urls.containsUserInfo( "https://www.local.com:8443aa@google.com"));

Review comment:
       +1




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org