Uploaded image for project: 'RESTEasy'
  1. RESTEasy
  2. RESTEASY-3686

Delete HeaderEmptyHostTest to unit test due to Undertow security hardening (UNDERTOW-2656) and lack of core framework relevance

XMLWordPrintable

      The integration test HeaderEmptyHostTest (originally introduced via RESTEASY-2300 / PR #2435) is failing on WildFly 39+. This failure is expected behavior following the fix for CVE-2025-12543 in Undertow, which now strictly rejects empty Host headers with a 400 Bad Request.

      Justification for Removal

      Upon review of the original PR this test was primarily intended to verify that the resteasy-netty4 utility class NettyUtil correctly handled empty host headers. However, there are several reasons why this test is no longer appropriate as an integration or unit test in RESTEasy Core:

      • Connector Responsibility: RFC 9112 compliance regarding the Host header is the responsibility of the underlying HTTP connector (Undertow, Netty, Jetty, etc.). As a JAX-RS implementation, RESTEasy sits above this layer. If the platform (WildFly) has made a security-driven decision to be more restrictive than the RFC, the framework should respect the container's boundary.
      • Redundancy in Mock Environment: Attempting to move this to a unit test using MockDispatcher provides no functional value. Such a test would only verify that RESTEasy's mock objects can store an empty string in a Map, rather than testing any meaningful request-processing logic or URI reconstruction.
      • Security Posture: Maintaining a test that asserts the validity of an empty Host header creates a conflict with modern security baselines (SSRF and Request Smuggling prevention) adopted by the primary runtimes supported by RESTEasy.

      Conclusion

      Since the original regression (a potential NPE in Netty utility code) has long been resolved and the test now conflicts with intentional security hardening in the target container, the test is being removed to maintain a green build and reflect the security requirements of WildFly 39+.

              jperkins-rhn James Perkins
              jperkins-rhn James Perkins
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: