Validate a given url against valid comma seperated list of domain names

[Prince Manchanda]

Hi,

When my application is invoked with a redirect url, I need to validate the redirect url against a predefined list of valid domains. For example the application can be invoked as follows:

www.mydomain.mycontext/myservlet?goto=http://www.foo.com

An example of the comma separated list of valid domain names that I have

www.doo.com,*foo.com,*.foo.com,www.foo.com, www.fo.com, *.fo.com

Now my application will validate the url in the goto request parameter against the predefined list(as mentioned above)

My question here is
what is the best way to validate the url against the comma separated list of domain names.

One option that I have is to token-ise the domain list and then see if the url contains the valid domain or not. This requires string parsing.
The other option of using URL or URI classes for this purpose doesn't work in case of wild cards.

[James Sabre]

Another possibility is to turn the list of domain names into a regular expression. For example, something along the lines of

String validDomainNames = "    www.doo.com,*foo.com,*.foo.com,www.foo.com, www.fo.com, *.fo.com";
        String validDomainNameRegex = validDomainNames.replaceAll("\\s+", "");
        validDomainNameRegex = validDomainNameRegex.replaceAll(",", "|");
        validDomainNameRegex = validDomainNameRegex.replaceAll("\\.", "\\\\.");
        validDomainNameRegex = validDomainNameRegex.replaceAll("\\*", "[0-9a-zA-Z]+");
        Pattern pattern = Pattern.compile(validDomainNameRegex);
        System.out.println(validDomainNameRegex);

        String[] goodValues =
        {
            "www.foo.com",
            "www1.foo.com",
            "wwwfoo.com",
        };
        for (String value : goodValues)
        {
            boolean isValid = pattern.matcher(value).matches();
            System.out.println(isValid + " " + value);
        } 

Of course you only need to compile the pattern once.

This has had the very minimal testing so if you decide to follow this approach you will need to create extensive JUnit test cases.

[Prince Manchanda]

Hi James,

Thanks for the quick response.

This is a good idea but as you pointed out needs a rigorous JUnit test suite. Like it fails for a valid url like http://www.doo.com/myContext/a.jsp

[James Sabre]

Prince Manchanda wrote:Like it fails for a valid url like http://www.doo.com/myContext/a.jsp

www.doo.com passes! You need to extract the domain name from the URL and then test.

It would be fairly easy to extend the approach so that it tested against the url and not just the domain name but I will leave that for you to do.

Even easier would be -

         boolean isValid = pattern.matcher(new URL(value).getHost()).matches();