WhatWgUrlParser throws StringIndexOutOfBoundsException for truncated percent-escape in opaque host

[shaggyinsomniac]

Description

WhatWgUrlParser.parse("foo://%4", ...) throws an unchecked StringIndexOutOfBoundsException when URL validation is enabled.

Analysis

In OpaqueHost.parse the percent-escape validation guard reads input.codePointAt(i + 2) after only checking input.length() - i < 2 — two code points must follow %, so the guard must require < 3. Additionally it checks isAsciiDigit where the URL spec (and the adjacent code comment) require ASCII hex digits.

Per the URL spec opaque-host parser, an invalid percent-escape is a (non-fatal) validation error: the host %4 is accepted.

Impact

Any caller that catches InvalidUrlException to return a 400 instead sees a raw runtime exception (500 / error-handling bypass).

Reproduction

WhatWgUrlParser.parse("foo://%4", UrlRecord.EMPTY, null, error -> {});  // StringIndexOutOfBoundsException

[bclozel]

Superseded by #37203