Issue #7789 : Accept underscores in host names when building the request origin - #8046
Merged
mattcasters merged 1 commit intoAug 21, 2026
Conversation
…e request origin
HttpHost.create(URI) reads URI.getHost(), which java.net.URI leaves null
whenever it treats the authority as registry-based rather than
server-based -- in practice because the host name contains an underscore.
For those URIs getPort() and getUserInfo() are unavailable too:
http://my_service.internal:8080/api
getHost() = null
getPort() = -1
getAuthority() = my_service.internal:8080
so the call fails with NullPointerException: Host name. Four call sites
share it: the HTTP and HTTP POST transforms, the Web Service transform and
HttpProtocol.
Add HttpClientManager.createHttpHost(URI), which uses getHost() when it is
available and otherwise parses the authority -- dropping userinfo, taking
the port when present and leaving IPv6 literals intact -- and route all
four call sites through it.
Underscores are not legal in host names per RFC 1123, but they are common
in internal and container DNS and they resolve, so a NullPointerException
is the wrong outcome.
Note on scope: the proxy configuration already tolerated underscores,
because HttpClientBuilderFacade#setProxy uses the HttpHost(scheme, host,
port) constructor, which does no URI parsing. The reproducible failure is
on the request target, so this fixes that path; asked on the issue for
confirmation of which leg was hit.
Seven tests cover a server-based authority, an underscored host with and
without a port, userinfo removal, an IPv6 literal, a URI with no host and
a non-numeric port. Five of them fail with NullPointerException: Host name
if createHttpHost delegates back to HttpHost.create.
mattcasters
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #7789 — with one correction to the scope, which I've also raised on the issue.
The proxy leg was already fine
Both transforms pass the proxy to
HttpClientManager.HttpClientBuilderFacade#setProxy, which buildsit with
new HttpHost(scheme, host, port)and sets it onRequestConfig. That constructor takes thehost name verbatim, so
my_proxy.internalsurvives it. Verified against httpcore5 5.4.The request target was not
Http#processRowandHttpPost#processRowcallHttpHost.create(uri), and that overload readsURI.getHost(). When a host name contains an underscore,java.net.URIclassifies the authority asregistry-based rather than server-based, and the parsed components are simply not available:
HttpHost.create(URI)then fails withNullPointerException: Host name. The same call appears inWebServiceand inHttpProtocol, so four call sites share the defect.Change
HttpClientManager.createHttpHost(URI)usesgetHost()when it is available and otherwise parsesthe authority — dropping userinfo, taking the port when one is present, and leaving IPv6 literals
intact. All four call sites now go through it.
Underscores are not legal in host names per RFC 1123, which the reporter rightly notes. But they are
common in internal and container DNS and they resolve, so failing with a
NullPointerExceptionrather than either working or reporting a clear error seems the wrong outcome either way.
Tests
Seven tests in a new
HttpClientManagerTest:IllegalArgumentExceptionrather than an NPE
Five of the seven fail with
NullPointerException: Host nameifcreateHttpHostis changed todelegate back to
HttpHost.create(uri).Verification
mvn -pl core,plugins/transforms/http,plugins/transforms/httppost,plugins/transforms/webservices -Pskip-uitest test— core 1138, http 37, httppost 25, webservices 6, all passing, 0 failures
mvn spotless:checkandmvn apache-rat:checkpass on the five touched modulesIf it turns out the reporter really did hit the proxy path rather than the target, then this is still
a genuine fix for the four call sites above but the issue would need to stay open — I've asked them
to confirm.