fix: handle non-absolute URLs in ExtensionValidator by netomi · Pull Request #2077 · eclipse-openvsx/openvsx · GitHub
Skip to content

fix: handle non-absolute URLs in ExtensionValidator - #2077

Merged
netomi merged 1 commit into
mainfrom
fix/2076-invalid-url-not-absolute
Aug 20, 2026
Merged

fix: handle non-absolute URLs in ExtensionValidator#2077
netomi merged 1 commit into
mainfrom
fix/2076-invalid-url-not-absolute

Conversation

@netomi

@netomi netomi commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

What

Fixes #2076 — publishing an extension fails with a 500 Internal Server Error:

Caused by: java.lang.IllegalArgumentException: URI is not absolute
        at java.base/java.net.URL.of(URL.java:820)
        at java.base/java.net.URI.toURL(URI.java:1176)
        at org.eclipse.openvsx.ExtensionValidator.isInvalidURL(ExtensionValidator.java:270)
        at org.eclipse.openvsx.ExtensionValidator.checkURL(ExtensionValidator.java:256)
        at org.eclipse.openvsx.ExtensionValidator.validateMetadata(ExtensionValidator.java:128)

Why

ExtensionValidator.isInvalidURL calls new URI(value).toURL() to validate homepage,
repository, bugs and qna metadata fields. URI#toURL() throws IllegalArgumentException
when the URI is syntactically valid but not absolute (e.g. a value with no scheme, such as
github.com/foo/bar). That exception isn't a URISyntaxException or MalformedURLException, so
the existing catch block let it propagate all the way out of the publish flow as an unhandled 500
error instead of being reported as a normal metadata validation issue.

Fix

  • Check URI#isAbsolute() explicitly before calling toURL() and treat a non-absolute URI as
    invalid.
  • Additionally catch IllegalArgumentException in the existing try/catch as a defensive backstop.

Testing

Added testNonAbsoluteURL and testNonAbsoluteURLWithGitPrefix to ExtensionValidatorTest,
covering a repository value with no scheme (with and without the git+ prefix). All tests in
ExtensionValidatorTest pass.

@netomi
fix: handle non-absolute URLs in ExtensionValidator (#2076)
a75bb82 
URI.toURL() throws IllegalArgumentException when the URI is
syntactically valid but not absolute (e.g. a homepage/repository/
bugs/qna value missing a scheme, such as "github.com/foo/bar").
That exception was not caught, so it propagated out of
isInvalidURL() and caused a 500 Internal Server Error during
publish instead of a normal metadata validation issue.

Explicitly check URI#isAbsolute() before calling toURL(), and
also catch IllegalArgumentException defensively.

Fixes #2076
@netomi
netomi requested review from cstamas and gnugomez and a lite review from Copilot August 20, 2026 09:07
Copilot AI reviewed Aug 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a publish-time 500 error in ExtensionValidator by correctly treating syntactically valid but non-absolute URIs (missing a scheme) as invalid metadata, ensuring the failure is reported as a normal validation issue rather than an unhandled exception.

Changes:

  • Update URL validation to explicitly reject non-absolute URIs before calling URI#toURL().
  • Add IllegalArgumentException handling as a defensive backstop during URL validation.
  • Add regression tests for non-absolute repository values (with and without git+ prefix) and modernize existing assertions to use getFirst().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
server/src/main/java/org/eclipse/openvsx/ExtensionValidator.java Prevents URI#toURL() from throwing on non-absolute URIs and treats them as invalid metadata.
server/src/test/java/org/eclipse/openvsx/ExtensionValidatorTest.java Adds regression coverage for non-absolute repository URLs and updates assertions accordingly.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@netomi

netomi commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

It is worth to mention that the VSC Marketplace seems to accept such extensions, but will not display malformed or invalid urls.
Open VSX checks for valid URLs if a value is provided before publication, so we should keep it like that imho but ensure that the proper error message is presented instead of returning back an internal server error.

@cstamas

cstamas commented Aug 20, 2026

Copy link
Copy Markdown
Member

@netomi
netomi merged commit 95274dd into main Aug 20, 2026
6 checks passed
@netomi
netomi deleted the fix/2076-invalid-url-not-absolute branch August 20, 2026 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@cstamas cstamas cstamas approved these changes
@gnugomez gnugomez Awaiting requested review from gnugomez

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

500 Internal Server Error while publishing new extensions

3 participants

@netomi @cstamas