Skip to content

Auto-port 5.0: HTTP/2: Parse request-target path like Vert.x#16855

Merged
normanmaurer merged 1 commit into
5.0from
auto-port-pr-16810-to-5.0
May 28, 2026
Merged

Auto-port 5.0: HTTP/2: Parse request-target path like Vert.x#16855
normanmaurer merged 1 commit into
5.0from
auto-port-pr-16810-to-5.0

Conversation

@netty-project-bot

Copy link
Copy Markdown
Contributor

Auto-port of #16810 to 5.0
Cherry-picked commit: a42c7fc


Motivation:

HttpConversionUtil.toHttp2Headers currently depends on java.net.URI for absolute-form request-target parsing. On JDKs that still enforce older URI syntax, path or query characters that appear in real HTTP request-targets can make HTTP/1.x to HTTP/2 conversion fail before :path is produced.

Netty only needs URI parsing for the lower-frequency scheme://authority validation/extraction path. The hot path/query extraction can follow the same lightweight parsing shape used by Vert.x while avoiding full URI parsing and avoiding a try/catch fallback.

Modification:

  • Split request-target path and query parsing into Vert.x-shaped parsePath and parseQuery helpers, with comments for Netty-specific differences.
  • Keep URI parsing for scheme://authority validation/extraction only after stripping path/query/fragment data.
  • Preserve origin-form and asterisk-form behavior.
  • Add regression tests for characters rejected by java.net.URI, authority-only and missing-authority absolute-form targets, empty query/fragment handling, and malformed authority validation.
  • Add a Jazzer fuzz test that compares the new behavior against the old URI-based conversion using broad consumeString(128) request-target input and narrow documented compatibility exceptions.

Result:

HTTP/2 conversion no longer relies on full java.net.URI parsing for request-target path/query extraction, while preserving meaningful existing behavior and continuing to validate/extract scheme and authority through URI where appropriate.

Verification performed locally:

  • ./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn test
  • JAZZER_FUZZ=1 ./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true -Dtest=HttpConversionUtilFuzzTest test
  • ./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp -DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true -Dsurefire.failIfNoSpecifiedTests=false -Dtest=HttpConversionUtilTest,HttpConversionUtilFuzzTest test

Motivation:

`HttpConversionUtil.toHttp2Headers` currently depends on `java.net.URI`
for absolute-form request-target parsing. On JDKs that still enforce
older URI syntax, path or query characters that appear in real HTTP
request-targets can make HTTP/1.x to HTTP/2 conversion fail before
`:path` is produced.

Netty only needs URI parsing for the lower-frequency
`scheme://authority` validation/extraction path. The hot path/query
extraction can follow the same lightweight parsing shape used by Vert.x
while avoiding full URI parsing and avoiding a try/catch fallback.

Modification:

- Split request-target path and query parsing into Vert.x-shaped
`parsePath` and `parseQuery` helpers, with comments for Netty-specific
differences.
- Keep `URI` parsing for `scheme://authority` validation/extraction only
after stripping path/query/fragment data.
- Preserve origin-form and asterisk-form behavior.
- Add regression tests for characters rejected by `java.net.URI`,
authority-only and missing-authority absolute-form targets, empty
query/fragment handling, and malformed authority validation.
- Add a Jazzer fuzz test that compares the new behavior against the old
URI-based conversion using broad `consumeString(128)` request-target
input and narrow documented compatibility exceptions.

Result:

HTTP/2 conversion no longer relies on full `java.net.URI` parsing for
request-target path/query extraction, while preserving meaningful
existing behavior and continuing to validate/extract scheme and
authority through URI where appropriate.

Verification performed locally:

- `./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp
-DskipHttp2Testsuite -DskipAutobahn test`
- `JAZZER_FUZZ=1 ./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp
-DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true
-Dtest=HttpConversionUtilFuzzTest test`
- `./mvnw -pl codec-http2 -Drevapi.skip=true -DskipJapicmp
-DskipHttp2Testsuite -DskipAutobahn -Dcheckstyle.skip=true
-Dsurefire.failIfNoSpecifiedTests=false
-Dtest=HttpConversionUtilTest,HttpConversionUtilFuzzTest test`

---------

Co-authored-by: multicode <multicode@yawk.at>
(cherry picked from commit a42c7fc)
@normanmaurer normanmaurer added this to the 5.0.0.Final milestone May 28, 2026
@normanmaurer normanmaurer merged commit ab9624b into 5.0 May 28, 2026
12 of 13 checks passed
@normanmaurer normanmaurer deleted the auto-port-pr-16810-to-5.0 branch May 28, 2026 12:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants