Add URL normalization test vectors and fix no-schema URL handling by Fivell · Pull Request #39 · didww/didww-api-3-java-sdk

Fivell · 2026-03-10T23:18:54Z

Summary

Fixed no-schema URL handling (prepend http://)
Added 15 hardcoded cross-SDK test vectors for URL normalization

Test plan

All 20 tests pass

Copilot

Pull request overview

This PR improves webhook signature validation by making URL normalization accept inputs without an explicit scheme (by prepending http://) and adds a parameterized test suite of cross-SDK URL normalization vectors to lock in expected signatures.

Changes:

Prepend http:// when the input URL lacks a :// scheme delimiter.
Add 15 URL normalization/signature “golden” vectors via a JUnit 5 parameterized test.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/main/java/com/didww/sdk/callback/RequestValidator.java`	Adjusts URL normalization to handle no-scheme URLs by prepending `http://`.
`src/test/java/com/didww/sdk/callback/RequestValidatorTest.java`	Adds parameterized test vectors to validate URL normalization + signature results across common URL variants.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-10T23:22:25Z

src/main/java/com/didww/sdk/callback/RequestValidator.java

+            if (!url.matches("^[a-zA-Z]+://.*")) {
+                url = "http://" + url;
+            }
            URI uri = URI.create(url);
            String scheme = uri.getScheme();
            String userInfo = uri.getUserInfo() != null ? uri.getUserInfo() + "@" : "";


normalizeUrl uses uri.getScheme() later to pick default ports and also includes it in the normalized URL. URI preserves the original scheme casing (e.g., HTTPS://... -> scheme "HTTPS"), but schemes are case-insensitive; this can cause signature mismatches and wrong default-port selection. Consider lowercasing the parsed scheme (and using the lowercased value consistently for both port selection and the returned normalized URL).

Copilot · 2026-03-10T23:22:25Z

src/main/java/com/didww/sdk/callback/RequestValidator.java

+            if (!url.matches("^[a-zA-Z]+://.*")) {
+                url = "http://" + url;
+            }


String#matches recompiles the regex on every call. Since normalizeUrl runs for every validation, consider avoiding regex here (e.g., a small character scan / indexOf("://")) or using a precompiled Pattern constant. If you keep regex, [A-Za-z][A-Za-z0-9+.-]*:// is a more RFC-compatible scheme pattern than ^[a-zA-Z]+://.

…alidator - Lowercase the URI scheme after parsing to handle mixed-case schemes correctly - Replace url.matches() with a precompiled static Pattern to avoid recompiling the regex on every call

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-11T08:09:15Z

src/main/java/com/didww/sdk/callback/RequestValidator.java

+            }
            URI uri = URI.create(url);
-            String scheme = uri.getScheme();
+            String scheme = uri.getScheme().toLowerCase();


uri.getScheme().toLowerCase() is locale-sensitive and can produce incorrect results under certain default locales (e.g., Turkish), which would break signature validation. Use locale-independent lowercasing (e.g., toLowerCase(Locale.ROOT)) when normalizing the scheme.

Copilot · 2026-03-11T08:09:16Z

src/test/java/com/didww/sdk/callback/RequestValidatorTest.java

+    static Stream<Object[]> urlNormalizationVectors() {
+        return Stream.of(
+            new Object[]{"http://foo.com/bar", "4d1ce2be656d20d064183bec2ab98a2ff3981f73"},
+            new Object[]{"http://foo.com:80/bar", "4d1ce2be656d20d064183bec2ab98a2ff3981f73"},


The method source currently returns Stream<Object[]>, which is less type-safe and harder to read/maintain than using JUnit 5's Stream<Arguments> (or a dedicated record/class). Switching to Arguments.of(url, expectedSignature) will improve clarity and avoids accidental argument-shape mistakes.

- Use toLowerCase(Locale.ROOT) for scheme normalization to avoid locale-dependent behavior (e.g. Turkish locale) - Restore SCHEME_PATTERN and no-scheme URL handling - Change Stream<Object[]> to Stream<Arguments> with Arguments.of() for type-safe JUnit 5 parameterized tests - Restore URL normalization test vectors

sonarqubecloud · 2026-03-11T09:58:06Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-11T10:01:23Z

src/test/java/com/didww/sdk/callback/RequestValidatorTest.java

+        RequestValidator validator = new RequestValidator("SOMEAPIKEY");
+        Map<String, String> payload = new LinkedHashMap<>();
+        payload.put("id", "1dd7a68b-e235-402b-8912-fe73ee14243a");
+        payload.put("status", "completed");
+        payload.put("type", "orders");
+


The payload setup here is duplicated across multiple tests in this class (same keys/values with only ordering differences). Extracting a small helper (e.g., a method that returns the common payload map) would reduce repetition and make it easier to update the test data consistently if the signature inputs change again.

Copilot · 2026-03-11T10:01:24Z

src/main/java/com/didww/sdk/callback/RequestValidator.java

+            if (!SCHEME_PATTERN.matcher(url).find()) {
+                url = "http://" + url;
+            }
            URI uri = URI.create(url);
-            String scheme = uri.getScheme();
+            String scheme = uri.getScheme().toLowerCase(Locale.ROOT);
            String userInfo = uri.getUserInfo() != null ? uri.getUserInfo() + "@" : "";
            String host = uri.getHost();


normalizeUrl prepends http:// when no scheme is detected, but some inputs (e.g., /path, //foo.com/bar, or other non-host relative forms) will parse with uri.getHost() == null and the method will return a normalized URL containing the literal string null as the host. Consider explicitly validating that uri.getHost() is non-null/non-empty (and optionally handling scheme-relative URLs starting with //) and returning ""/failing validation instead of producing a canonical form with a null host.

Add URL normalization test vectors and fix no-schema URL handling

9be6d54

Fivell requested a review from Copilot March 10, 2026 23:18

Copilot started reviewing on behalf of Fivell March 10, 2026 23:19 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Fix scheme case sensitivity and avoid regex recompilation in RequestV…

f2a5fbb

…alidator - Lowercase the URI scheme after parsing to handle mixed-case schemes correctly - Replace url.matches() with a precompiled static Pattern to avoid recompiling the regex on every call

Fivell requested a review from Copilot March 11, 2026 08:05

Copilot started reviewing on behalf of Fivell March 11, 2026 08:05 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Fivell requested a review from Copilot March 11, 2026 09:58

Copilot started reviewing on behalf of Fivell March 11, 2026 09:58 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add URL normalization test vectors and fix no-schema URL handling#39

Add URL normalization test vectors and fix no-schema URL handling#39
Fivell wants to merge 3 commits intomainfrom
test/request-validator-vectors

Fivell commented Mar 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 10, 2026

Uh oh!

Copilot AI Mar 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

sonarqubecloud bot commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Fivell commented Mar 10, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Mar 11, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants