Make Uri parser more restrictive

asoltysik commented 6 years ago

Currently it allows for some invalid URIs, which lead to runtime errors when passed to Apache HTTP (thrown by java.net.URI) or AsyncHttpClient.

Examples of invalid URIs which pass hammock.Uri.fromString parser:

::
^&%$#@!
http://^&%$#@!/foo
empty string and/or whitespace

A couple of ideas for how to solve this:

Wrap and use java.net.URI constructor as a parser, in type-safe way (probably the easiest)
Use a library like: https://github.com/lemonlabsuk/scala-uri
Improve existing parser/write/port a parser from scratch (https://tools.ietf.org/html/rfc3986)

I'd be happy to contribute once you decide on direction.

miciek commented 5 years ago

@asoltysik Thanks! I think second option would be the best. I haven't used at scala-uri but it looks like it's way better than java.net.URI.

asoltysik commented 5 years ago

Looking at scala-uri it uses parboiled, which is a java library with scala wrapper. IIRC that makes it not an option as hammock is cross-published to ScalaJS.

pepegar commented 5 years ago

Yeah, the idea behind creating our own was to have something that worked for both scalaJS & JVM (and potentially scala native)

miciek commented 5 years ago

OK, @asoltysik I think that the only way forward then is to improve existing parser :)

pepegar / hammock

Make Uri parser more restrictive #113