Skip to content

Issue #7789 : Accept underscores in host names when building the request origin - #8046

Merged
mattcasters merged 1 commit into
apache:mainfrom
vbhanuchander-lang:issue-7789-underscored-proxy-host
Aug 21, 2026
Merged

Issue #7789 : Accept underscores in host names when building the request origin#8046
mattcasters merged 1 commit into
apache:mainfrom
vbhanuchander-lang:issue-7789-underscored-proxy-host

Conversation

@vbhanuchander-lang

Copy link
Copy Markdown
Contributor

Addresses #7789 — with one correction to the scope, which I've also raised on the issue.

The proxy leg was already fine

Both transforms pass the proxy to HttpClientManager.HttpClientBuilderFacade#setProxy, which builds
it with new HttpHost(scheme, host, port) and sets it on RequestConfig. That constructor takes the
host name verbatim, so my_proxy.internal survives it. Verified against httpcore5 5.4.

The request target was not

Http#processRow and HttpPost#processRow call HttpHost.create(uri), and that overload reads
URI.getHost(). When a host name contains an underscore, java.net.URI classifies the authority as
registry-based rather than server-based, and the parsed components are simply not available:

http://my_service.internal:8080/api
   URI.getHost()      = null
   URI.getPort()      = -1
   URI.getUserInfo()  = null
   URI.getAuthority() = my_service.internal:8080

HttpHost.create(URI) then fails with NullPointerException: Host name. The same call appears in
WebService and in HttpProtocol, so four call sites share the defect.

Change

HttpClientManager.createHttpHost(URI) uses getHost() when it is available and otherwise parses
the authority — dropping userinfo, taking the port when one is present, and leaving IPv6 literals
intact. All four call sites now go through it.

Underscores are not legal in host names per RFC 1123, which the reporter rightly notes. But they are
common in internal and container DNS and they resolve, so failing with a NullPointerException
rather than either working or reporting a clear error seems the wrong outcome either way.

Tests

Seven tests in a new HttpClientManagerTest:

  • a normal server-based authority
  • an underscored host with a port, and without one
  • userinfo dropped from the origin
  • an IPv6 literal kept intact
  • a URI with no host at all, and a non-numeric port — both rejected with IllegalArgumentException
    rather than an NPE

Five of the seven fail with NullPointerException: Host name if createHttpHost is changed to
delegate back to HttpHost.create(uri).

Verification

  • mvn -pl core,plugins/transforms/http,plugins/transforms/httppost,plugins/transforms/webservices -Pskip-uitest test
    — core 1138, http 37, httppost 25, webservices 6, all passing, 0 failures
  • mvn spotless:check and mvn apache-rat:check pass on the five touched modules

If it turns out the reporter really did hit the proxy path rather than the target, then this is still
a genuine fix for the four call sites above but the issue would need to stay open — I've asked them
to confirm.


…e request origin

HttpHost.create(URI) reads URI.getHost(), which java.net.URI leaves null
whenever it treats the authority as registry-based rather than
server-based -- in practice because the host name contains an underscore.
For those URIs getPort() and getUserInfo() are unavailable too:

  http://my_service.internal:8080/api
     getHost()      = null
     getPort()      = -1
     getAuthority() = my_service.internal:8080

so the call fails with NullPointerException: Host name. Four call sites
share it: the HTTP and HTTP POST transforms, the Web Service transform and
HttpProtocol.

Add HttpClientManager.createHttpHost(URI), which uses getHost() when it is
available and otherwise parses the authority -- dropping userinfo, taking
the port when present and leaving IPv6 literals intact -- and route all
four call sites through it.

Underscores are not legal in host names per RFC 1123, but they are common
in internal and container DNS and they resolve, so a NullPointerException
is the wrong outcome.

Note on scope: the proxy configuration already tolerated underscores,
because HttpClientBuilderFacade#setProxy uses the HttpHost(scheme, host,
port) constructor, which does no URI parsing. The reproducible failure is
on the request target, so this fixes that path; asked on the issue for
confirmation of which leg was hit.

Seven tests cover a server-based authority, an underscored host with and
without a port, userinfo removal, an IPv6 literal, a URI with no host and
a non-numeric port. Five of them fail with NullPointerException: Host name
if createHttpHost delegates back to HttpHost.create.
@mattcasters
mattcasters merged commit 18ba732 into apache:main Aug 21, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants