Merge branch 'master' of https://github.com/apache/commons-validator.git

Author: garydgregory

src/changes/changes.xml

@@ -91,6 +91,7 @@ The <action> type attribute can be add,update,fix,remove.
     <action type="fix" dev="ggregory" due-to="sahvx655-wq, Gary Gregory">Preserve exact value in BigDecimal and BigInteger validate (#406).</action>
     <action type="fix" dev="ggregory" due-to="sahvx655-wq, Gary Gregory">Preserve fractional bound in BigIntegerValidator range checks (#407).</action>
     <action type="fix" dev="sebb" due-to="sahvx655-wq">DomainValidatorTest: ensure CC is in correct list (#409).</action>
+    <action type="fix" dev="sebb" due-to="sahvx655-wq">range-check the port for IPv6 hosts in isValidAuthority (#412).</action>
     <action type="fix" dev="sebb">Fix deprecations in test classes.</action>
     <!-- ADD -->
     <action type="add" dev="ggregory" due-to="Gary Gregory">Add and use CheckDigitException.CheckDigitException(String, Object...) (#389).</action>

src/main/java/org/apache/commons/validator/routines/UrlValidator.java

@@ -443,16 +443,19 @@ protected boolean isValidAuthority(final String authority) {
                     return false;
                 }
             }
-            final String port = authorityMatcher.group(PARSE_AUTHORITY_PORT);
-            if (!GenericValidator.isBlankOrNull(port)) {
-                try {
-                    final int iPort = Integer.parseInt(port);
-                    if (iPort < 0 || iPort > MAX_UNSIGNED_16_BIT_INT) {
-                        return false;
-                    }
-                } catch (final NumberFormatException nfe) {
-                    return false; // this can happen for big numbers
+        }
+
+        // the port is captured in the same group regardless of host form, so it must be
+        // range checked for a bracketed IPv6 host too, not just the hostname/IPv4 branch
+        final String port = authorityMatcher.group(PARSE_AUTHORITY_PORT);
+        if (!GenericValidator.isBlankOrNull(port)) {
+            try {
+                final int iPort = Integer.parseInt(port);
+                if (iPort < 0 || iPort > MAX_UNSIGNED_16_BIT_INT) {
+                    return false;
                 }
+            } catch (final NumberFormatException nfe) {
+                return false; // this can happen for big numbers
             }
         }
 

src/test/java/org/apache/commons/validator/routines/UrlValidatorTest.java

@@ -173,6 +173,17 @@ void testIpv6EmbeddedIpv4() {
         assertFalse(urlValidator.isValid("http://[::ffff:129.144.52.999]/"));
     }
 
+    @Test
+    void testIpv6Port() {
+        final UrlValidator urlValidator = new UrlValidator();
+        // a port on a bracketed IPv6 host must be range checked just like a hostname/IPv4 host
+        assertTrue(urlValidator.isValid("http://[::1]:65535/index.html"));
+        assertFalse(urlValidator.isValid("http://[::1]:65536/index.html"));
+        assertFalse(urlValidator.isValid("http://[::1]:99999/index.html"));
+        assertTrue(urlValidator.isValidAuthority("[::1]:65535"));
+        assertFalse(urlValidator.isValidAuthority("[::1]:65536"));
+    }
+
     @ParameterizedTest
     // @formatter:off
     @ValueSource(strings = {