[cors] Use JDK's URI class by Playacem · Pull Request #2180 · javalin/javalin

Playacem · 2024-03-04T19:36:01Z

Todos:

tests for IPv4 addresses as an origin
tests for IPv6 addresses as an origin
harden port extraction especially for IPv6 addresses
Use URI class for port logic
complete plugin tests for IP address based origins

Fixes #2138 (once its done)

codecov · 2024-03-04T19:49:20Z

Codecov Report

❌ Patch coverage is 91.30435% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.68%. Comparing base (1e95587) to head (a2ab0dd).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
...c/main/java/io/javalin/plugin/bundled/CorsUtils.kt	89.47%	0 Missing and 4 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2180      +/-   ##
============================================
+ Coverage     86.54%   86.68%   +0.13%     
+ Complexity     1446     1435      -11     
============================================
  Files           153      153              
  Lines          4200     4184      -16     
  Branches        477      468       -9     
============================================
- Hits           3635     3627       -8     
+ Misses          369      364       -5     
+ Partials        196      193       -3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

tipsy · 2024-07-05T22:31:04Z

How is this PR going @Playacem ?

Playacem · 2024-07-06T05:25:42Z

I have been quite busy with real life, but I finally have some time this weekend to work on it.

tipsy · 2024-07-06T06:58:50Z

I have been quite busy with real life, but I finally have some time this weekend to work on it.

Me too, no rush ☺️

tipsy · 2025-03-02T19:21:42Z

marked this pull request as ready for review 4 months ago

I guess it's ready for review? 😅

Playacem · 2025-03-03T06:18:53Z

It is :)

Copilot

Pull Request Overview

This pull request updates the CORS support to use JDK’s URI class for more robust origin parsing. Key changes include updating tests to use parameterized inputs for various origin scenarios (IPv4, IPv6, wildcards), refactoring CorsUtils to remove the PortResult abstraction in favor of boolean validations and exception handling, and revising CorsPlugin to integrate with the new utility methods.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
javalin/src/test/java/io/javalin/TestCorsUtils.kt	Replaces individual tests with parameterized tests and updates origin parsing expectations
javalin/src/test/java/io/javalin/TestCors.kt	Adds new tests for IPv4/IPv6 and wildcard handling and verifies error messages for invalid origins
javalin/src/main/java/io/javalin/plugin/bundled/CorsUtils.kt	Removes PortResult, adds URI‑based origin validation and parsing, and handles wildcard origins
javalin/src/main/java/io/javalin/plugin/bundled/CorsPlugin.kt	Updates usage of CorsUtils methods and refines error handling for origin validation

Copilot · 2025-06-13T17:20:04Z

+        val wildcardSnippet = "://*."
+        val hasWildcard = wildcardSnippet in origin
+        if (client && hasWildcard) {
+            return false
        }
-        val possiblePortDigits = origin.subSequence(possiblePortIndex + 1, origin.length).toString()
-        if (possiblePortDigits.any { !it.isAsciiDigit() }) {
-            return PortResult.ErrorState.InvalidPort
+        val originWithoutWildcard = origin.replace(wildcardSnippet, "://")


[nitpick] Consider handling possible variations of wildcard placement or formatting rather than relying solely on the literal substring "://*." to ensure robust matching.

Suggested change

val wildcardSnippet = "://*."

val hasWildcard = wildcardSnippet in origin

if (client && hasWildcard) {

return false

}

val possiblePortDigits = origin.subSequence(possiblePortIndex + 1, origin.length).toString()

if (possiblePortDigits.any { !it.isAsciiDigit() }) {

return PortResult.ErrorState.InvalidPort

val originWithoutWildcard = origin.replace(wildcardSnippet, "://")

val wildcardRegex = Regex("://\\*\\.")

val hasWildcard = wildcardRegex.containsMatchIn(origin)

if (client && hasWildcard) {

return false

}

val originWithoutWildcard = origin.replace(wildcardRegex, "://")

Copilot · 2025-06-13T17:20:05Z

-            return PortResult.ErrorState.InvalidPort
+        val originWithoutWildcard = origin.replace(wildcardSnippet, "://")
+        val originToAnalyze = if (hasWildcard) originWithoutWildcard else origin
+        try {


[nitpick] Consider catching more specific exceptions (e.g. URISyntaxException) here instead of a generic Exception to make error handling more explicit.

We need to specify junit-jupiter-params directly to force JUnit 6. We previously had this on our classpath as a transitive dependency from mockk, leading to a version mismatch and failing parameterized tests. We could also switch over to the junit-jupiter artifact which combines api, params and runtime.

tipsy · 2025-11-30T19:11:37Z

Looks great @Playacem, thank you very much 🙌

tipsy force-pushed the master branch 4 times, most recently from 765b7d0 to 6faa186 Compare May 8, 2024 16:19

Playacem force-pushed the gh-2138-cors-jdk-uri branch from 12e07b7 to 34371f6 Compare May 13, 2024 19:24

Playacem force-pushed the gh-2138-cors-jdk-uri branch from 34371f6 to 6d6d995 Compare May 22, 2024 15:42

Playacem force-pushed the gh-2138-cors-jdk-uri branch from 6d6d995 to 1df3f7d Compare July 6, 2024 10:23

Playacem added 13 commits November 2, 2024 10:16

Use Parameterized Tests for TestCorsUtils

495e157

First version of an alternative isValidOrigin

6e77707

Improve coverage for rare code paths

91057b3

Some more cors test

10f6aac

Test CORS port stuff end to end

041fca9

[cors] Integrate normalization into origin parsing

5fd45f5

[cors] alternative Implementation for creating origin parts

57dec79

[cors] Use compiler instead of never reached exception

5543334

[cors] Document workaround for javalinGH-2246

d2ed91e

[cors] IP Addresses tests

8b238a5

[cors] Support wildcard in isValidOriginJdk for feature parity

1cf6556

[cors] Add static feature flag for new and old cors parser functions

12338ed

[cors] Fix missed function references to use the indirection correctly

4cdeb24

Playacem force-pushed the gh-2138-cors-jdk-uri branch from 8740c5c to 4cdeb24 Compare November 2, 2024 09:16

Playacem added 3 commits November 2, 2024 11:57

[cors] Differentiate between client and server provided origins

53e0ea0

[cors] Reject user info in Origins

7c953cb

[cors] Remove old non JDK CORS parsing implementation

8625135

Playacem marked this pull request as ready for review November 3, 2024 11:17

zugazagoitia requested a review from Copilot June 13, 2025 17:19

Copilot AI reviewed Jun 13, 2025

View reviewed changes

tipsy force-pushed the master branch from d31e2eb to d7d3876 Compare October 30, 2025 22:19

tipsy and others added 2 commits November 28, 2025 21:06

Merge branch 'master' into javalingh-2138-cors-jdk-uri

c3037ed

tipsy merged commit a81cafa into javalin:master Nov 30, 2025
19 of 20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[cors] Use JDK's URI class#2180

[cors] Use JDK's URI class#2180
tipsy merged 18 commits intojavalin:masterfrom
Playacem:gh-2138-cors-jdk-uri

Playacem commented Mar 4, 2024 •

edited

Loading

Uh oh!

codecov bot commented Mar 4, 2024 •

edited

Loading

Uh oh!

tipsy commented Jul 5, 2024

Uh oh!

Playacem commented Jul 6, 2024

Uh oh!

tipsy commented Jul 6, 2024

Uh oh!

tipsy commented Mar 2, 2025

Uh oh!

Playacem commented Mar 3, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jun 13, 2025

Uh oh!

Copilot AI Jun 13, 2025

Uh oh!

tipsy commented Nov 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Playacem commented Mar 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tipsy commented Jul 5, 2024

Uh oh!

Playacem commented Jul 6, 2024

Uh oh!

tipsy commented Jul 6, 2024

Uh oh!

tipsy commented Mar 2, 2025

Uh oh!

Playacem commented Mar 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

tipsy commented Nov 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Playacem commented Mar 4, 2024 •

edited

Loading

codecov bot commented Mar 4, 2024 •

edited

Loading