Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8282395

URL.openConnection can throw IOOBE

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P4
    • 20
    • 18
    • core-libs
    • None
    • b19

    Description

      An incomplete input validation in the URL class can cause an IOOBE to be
      thrown from the openConnection method, where according to the API
      documentation no exception is expected to be thrown.

      A jshell PoC:

      jshell> new URL("ftp://.:%@")
      $1 ==> ftp://.:%@

      jshell> $1.openConnection()
      | Exception java.lang.IndexOutOfBoundsException
      | at Integer.parseInt (Integer.java:706)
      | at ParseUtil.unescape (ParseUtil.java:163)
      | at ParseUtil.decode (ParseUtil.java:199)
      | at FtpURLConnection.<init> (FtpURLConnection.java:204)
      | at Handler.openConnection (Handler.java:61)
      | at Handler.openConnection (Handler.java:56)
      | at URL.openConnection (URL.java:1126)
      | at (#2:1)
        

      Attachments

        Issue Links

          Activity

            People

              dfuchs Daniel Fuchs
              mschoene Marc Schönefeld
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: