URI와 브라우저 요청

package board.http;

import static org.junit.jupiter.api.Assertions.assertEquals;

import java.net.URI;
import org.junit.jupiter.api.Test;

class UriPartsTest {
    @Test
    void 게시글_URI를_구성_요소로_분해한다() {
        var uri = URI.create(
                "https://board.example:8443"
                        + "/api/posts/42"
                        + "?view=compact#notes");

        assertEquals("https", uri.getScheme());
        assertEquals("board.example", uri.getHost());
        assertEquals(8443, uri.getPort());
        assertEquals("/api/posts/42", uri.getPath());
        assertEquals("view=compact", uri.getQuery());
        assertEquals("notes", uri.getFragment());
    }

    @Test
    void raw와_decoded_구성_요소를_구분한다() {
        var uri = URI.create(
                "https://board.example/api/titles/network%2Fhttp"
                        + "?title=Spring%20MVC%20%26%20HTTP");

        assertEquals(
                "/api/titles/network%2Fhttp",
                uri.getRawPath());
        assertEquals(
                "/api/titles/network/http",
                uri.getPath());
        assertEquals(
                "title=Spring%20MVC%20%26%20HTTP",
                uri.getRawQuery());
        assertEquals(
                "title=Spring MVC & HTTP",
                uri.getQuery());
        assertEquals(-1, uri.getPort());
    }

    @Test
    void 상대_URI를_base_URI에_해석한다() {
        var base = URI.create(
                "https://board.example/members/7/");

        assertEquals(
                URI.create(
                        "https://board.example/members/"
                                + "posts?limit=20"),
                base.resolve("../posts?limit=20"));
    }
}

package board.http;

import static org.junit.jupiter.api.Assertions.assertEquals;

import java.util.Map;
import org.junit.jupiter.api.Test;
import org.springframework.web.util.UriComponentsBuilder;

class BoardUriBuilderTest {
    @Test
    void encode_후_expand하면_변수를_불투명한_데이터로_보존한다() {
        var uri = UriComponentsBuilder
                .fromPath("/api/titles/{title}/posts")
                .queryParam("q", "{query}")
                .queryParam("limit", "{limit}")
                .encode()
                .buildAndExpand(Map.<String, Object>of(
                        "title", "network/http",
                        "query", "a/b?c+d&e=f",
                        "limit", 20))
                .toUri();

        assertEquals(
                "/api/titles/network%2Fhttp/posts",
                uri.getRawPath());
        assertEquals(
                "q=a%2Fb%3Fc%2Bd%26e%3Df&limit=20",
                uri.getRawQuery());
    }

    @Test
    void expand_후_component_encode하면_path의_slash를_보존한다() {
        var uri = UriComponentsBuilder
                .fromPath("/api/titles/{title}/posts")
                .buildAndExpand("network/http")
                .encode()
                .toUri();

        assertEquals(
                "/api/titles/network/http/posts",
                uri.getRawPath());
    }
}

GET /api/posts/42?view=compact HTTP/1.1
Host: board.example:8443
Accept: application/json

package board.web;

import java.net.URI;
import java.util.List;

public final class SafeReturnPath {
    private static final List<String> ALLOWED_ROOTS =
            List.of("/posts", "/members");

    public static String requireLocal(String candidate) {
        if (candidate == null) {
            throw invalidReturnPath();
        }

        final URI uri;
        try {
            uri = URI.create(candidate);
        } catch (IllegalArgumentException exception) {
            throw invalidReturnPath(exception);
        }

        var rawPath = uri.getRawPath();
        if (uri.isAbsolute()
                || uri.isOpaque()
                || uri.getRawAuthority() != null
                || rawPath == null
                || !rawPath.startsWith("/")
                || candidate.startsWith("//")
                || uri.getRawFragment() != null
                || rawPath.indexOf('%') >= 0
                || rawPath.indexOf('\\') >= 0
                || rawPath.chars()
                        .anyMatch(character -> character > 0x7f)) {
            throw invalidReturnPath();
        }

        var normalized = uri.normalize();
        var normalizedPath = normalized.getRawPath();
        var allowed = ALLOWED_ROOTS.stream()
                .anyMatch(root -> normalizedPath.equals(root)
                        || normalizedPath.startsWith(root + "/"));
        if (!allowed) {
            throw invalidReturnPath();
        }

        return normalized.toASCIIString();
    }

    private static IllegalArgumentException invalidReturnPath() {
        return new IllegalArgumentException(
                "return path must match an allowed local route");
    }

    private static IllegalArgumentException invalidReturnPath(
            IllegalArgumentException cause) {
        return new IllegalArgumentException(
                "return path must match an allowed local route",
                cause);
    }

    private SafeReturnPath() {
    }
}

package board.web;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;

import java.util.List;
import org.junit.jupiter.api.Test;

class SafeReturnPathTest {
    @Test
    void 허용한_경로와_query를_보존하고_dot_segment를_정규화한다() {
        assertEquals(
                "/posts/42?view=compact",
                SafeReturnPath.requireLocal(
                        "/posts/42?view=compact"));
        assertEquals(
                "/members/7/posts?filter=a%26b",
                SafeReturnPath.requireLocal(
                        "/members/7/posts?filter=a%26b"));
        assertEquals(
                "/posts/42",
                SafeReturnPath.requireLocal("/posts/./42"));
    }

    @Test
    void 출처를_바꿀_수_있는_참조를_거부한다() {
        var candidates = List.of(
                "https://evil.example/posts",
                "//evil.example/posts",
                "///evil.example/posts",
                "///posts/42");

        for (var candidate : candidates) {
            assertThrows(
                    IllegalArgumentException.class,
                    () -> SafeReturnPath.requireLocal(candidate),
                    candidate);
        }
    }

    @Test
    void 허용_목록_밖과_traversal과_prefix_collision을_거부한다() {
        var candidates = List.of(
                "/admin",
                "/postscript",
                "/posts/../admin",
                "/members/../../admin");

        for (var candidate : candidates) {
            assertThrows(
                    IllegalArgumentException.class,
                    () -> SafeReturnPath.requireLocal(candidate),
                    candidate);
        }
    }

    @Test
    void encoded_path와_backslash와_fragment를_거부한다() {
        var candidates = List.of(
                "/posts/%2e%2e/admin",
                "/posts/%2Fadmin",
                "/posts/%5Cadmin",
                "/posts/%252e%252e/admin",
                "/posts/42#notes",
                "/posts/한글",
                "\\\\evil.example\\posts");

        for (var candidate : candidates) {
            assertThrows(
                    IllegalArgumentException.class,
                    () -> SafeReturnPath.requireLocal(candidate),
                    candidate);
        }
    }
}