You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Jan Høydahl (Jira)" <ji...@apache.org> on 2026/09/10 07:52:00 UTC
[jira] [Updated] (SOLR-18293) AllowListUrlChecker uses inconsistent URL scheme detection compared to shard URL fetching
[ https://issues.apache.org/jira/browse/SOLR-18293?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jan Høydahl updated SOLR-18293:
-------------------------------
Security: (was: Private (Security Issue))
> AllowListUrlChecker uses inconsistent URL scheme detection compared to shard URL fetching
> -----------------------------------------------------------------------------------------
>
> Key: SOLR-18293
> URL: https://issues.apache.org/jira/browse/SOLR-18293
> Project: Solr
> Issue Type: Bug
> Reporter: Jan Høydahl
> Assignee: Jan Høydahl
> Priority: Major
> Fix For: 10.1, 9.11
>
> Attachments: SOLR-18293.patch
>
>
> {{AllowListUrlChecker}} (the {{allowUrls}} / shard URL allow-list) derived a URL's host:port using its own protocol-detection regex, while the shard URL fetch path ({{{}HttpShardHandlerFactory#buildUrl{}}}) detects the scheme with {{{}URLUtil#hasScheme{}}}. Because the two used different rules for what counts as a scheme, URLs with non-standard scheme prefixes were parsed inconsistently between validation and fetching.
> For example, values such as {{{}s3://host:8983/solr{}}}, {{HTTP://host:8983/solr}} and {{12345://host:8983/solr}} were accepted/normalized by the checker but would be interpreted differently when the URL was actually built and fetched.
> With the attached patch, {{parseHostPort}} now detects the scheme with {{URLUtil#hasScheme}} — the same helper the shard URL fetch uses — so both code paths interpret a given URL identically. URLs whose prefix is not a recognized scheme are now consistently rejected with {{{}MalformedURLException{}}}; ordinary {{host:port}} and {{http(s)://host:port}} entries are unaffected. This also simplifies code and removes some lines.
> Reported by Rajat Raghav (Xclow3n).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org