Package com.vaadin.flow.internal

Class UrlUtil

java.lang.Object
com.vaadin.flow.internal.UrlUtil
public class UrlUtil extends Object
Internal utility class for URL handling.

For internal use only. May be renamed or removed in a future release.

Since:
2.0
Author:
Vaadin Ltd

  • Method Details

    • isExternal

      public static boolean isExternal(String url)
      checks if the given url is an external URL (e.g. staring with http:// or https://) or not.
      Parameters:
      url - is the url to be checked.
      Returns:
      true if the url is external otherwise false.

    • encodeURI

      public static String encodeURI(String uri)
      Encodes a full URI.

      Corresponds to encodeURI in JavaScript https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI

      The path can contain / and other special URL characters as these will not be encoded. See encodeURIComponent(String) if you want to encode all special characters.

      The following characters are not escaped: A-Za-z0-9;,/?:@&=+$-_.!~*'()#

      Parameters:
      uri - the uri to encode
      Returns:
      the encoded URI
      Since:
      9.0

    • encodeURIComponent

      public static String encodeURIComponent(String path)
      Encodes a path segment of a URI.

      Corresponds to encodeURIComponent in JavaScript https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent

      The following characters are not escaped: A-Za-z0-9-_.!~*'()

      Parameters:
      path - the path to encode
      Returns:
      the encoded path
      Since:
      9.0

    • decodeURIComponent

      public static String decodeURIComponent(String encoded)
      Decodes a percent-encoded string according to RFC 3986.

      Corresponds to decodeURIComponent in JavaScript https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURIComponent

      Unlike URLDecoder, this method does not treat '+' as a space character, making it suitable for decoding strings encoded with JavaScript's encodeURIComponent() or encodeURIComponent(String).

      Parameters:
      encoded - the percent-encoded string
      Returns:
      the decoded string
      Since:
      24.9.12

    • appendQueryParameter

      public static String appendQueryParameter(String url, String name, String value)
      Appends a query parameter to the given URL. Uses ? if the URL has no query string yet, or & if it already has one. Returns the original URL unchanged if either name or value is null.
      Parameters:
      url - the original URL
      name - the parameter name, or null to skip
      value - the parameter value, or null to skip
      Returns:
      the URL with the parameter appended, or the original URL if name or value is null
      Since:
      25.1

    • getServletPathRelative

      public static String getServletPathRelative(String absolutePath, jakarta.servlet.http.HttpServletRequest request)
      Returns the given absolute path as a path relative to the servlet path.
      Parameters:
      absolutePath - the path to make relative
      request - a request with information about the servlet path
      Returns:
      a relative path that when applied to the servlet path, refers to the absolute path without containing the context path or servlet path
      Since:
      23.3

    • isSafeUrl

      @Deprecated(since="25.3") public static boolean isSafeUrl(String url)
      Deprecated.
      use validateUrl(Component, String, String, String, SerializableRunnable) instead, as it uses the configuration of the application that the component belongs to instead of relying on the current thread having a locked session
      Checks whether the scheme of the given URL is considered safe by the current deployment configuration.

      The set of safe schemes is read from the current VaadinService's DeploymentConfiguration.getUrlSafeSchemes(), falling back to Constants.DEFAULT_URL_SAFE_SCHEMES when no VaadinService is available. Relative URLs (without a scheme) and about:blank are always considered safe, whereas URLs containing control characters are rejected as they can be used to obfuscate the scheme. A null URL is considered unsafe.

      Parameters:
      url - the URL to check, may be null
      Returns:
      true if the URL is safe, false otherwise
      Since:
      25.1.12

    • validateUrl

      public static void validateUrl(Component component, String type, String url, String unsafeMethod)
      Validates a URL that is set for a component that is attached to a UI which belongs to a VaadinSession, such as a UI itself.
      Parameters:
      component - the component that the URL is set for, not null
      type - the kind of URL being set, for example "href"
      url - the URL to validate, not null
      unsafeMethod - the signature of the method that bypasses validation, for example "setUnsafeHref(String)"
      Throws:
      IllegalArgumentException - if the URL uses a scheme that is not considered safe
      IllegalStateException - if the configuration of the application cannot be found through the given component
      Since:
      25.3
      See Also:

    • validateUrl

      public static void validateUrl(Component component, String type, String url, String unsafeMethod, SerializableRunnable urlClearer)
      Validates a URL that is set for a component, using the InitParameters.URL_SAFE_SCHEMES configuration of the application that the component belongs to.

      The set of safe schemes is read from the VaadinService of the component's own UI. A component that isn't attached yet is thus validated when it is attached, which is the first point where the application is known and also the point where the value would first be sent to the browser.

      If the URL isn't safe, then the value is cleared through urlClearer before an IllegalArgumentException is thrown, so that an unsafe URL isn't sent to the client even if the application catches the exception.

      Any previously deferred validation for the same component and type is canceled. Use cancelUrlValidation(Component, String) when the value is replaced through a method that doesn't validate it.

      Parameters:
      component - the component that the URL is set for, not null
      type - the kind of URL being set, for example "href"
      url - the URL to validate, not null
      unsafeMethod - the signature of the method that bypasses validation, for example "setUnsafeHref(String)"
      urlClearer - clears the URL value of the component, not null
      Throws:
      IllegalArgumentException - if the component is attached and the URL uses a scheme that is not considered safe
      Since:
      25.3

    • cancelUrlValidation

      public static void cancelUrlValidation(Component component, String type)
      Cancels a check scheduled by validateUrl(Component, String, String, String, SerializableRunnable), for example because the value has been replaced through a method that doesn't validate it. Does nothing if no check is scheduled.
      Parameters:
      component - the component that the URL is set for, not null
      type - the kind of URL, for example "href"
      Since:
      25.3

    • getUnsafeUrlMessage

      public static String getUnsafeUrlMessage(String type, String url, String unsafeMethod)
      Builds the message for the IllegalArgumentException that a validating URL setter throws when given a URL whose scheme is not considered safe. The message points to both the InitParameters.URL_SAFE_SCHEMES configuration property and the setter that bypasses validation.
      Parameters:
      type - the kind of URL being set, for example "href", "src" or "path"
      url - the rejected URL
      unsafeMethod - the signature of the method that bypasses validation, for example "setUnsafeHref(String)"
      Returns:
      the exception message
      Since:
      25.1.12