[Cronet] Public key pinning for Java API

components/cronet/android/api/src/org/chromium/net/CronetUtil.java

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+package org.chromium.net;
+
+import java.net.IDN;
+import java.util.regex.Pattern;
+
+/**
+ * A set of generic utility methods.
+ */
+class CronetUtil {
+    private static final String VALID_IP_EXPR = "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])"

[estark, 2015/11/10 19:04:16]

Where are these regexes from? It's difficult for me to tell if they're correct.
Did you consider doing something more like what
https://code.google.com/p/chromium/codesearch#chromium/src/url/url_canon.h&sq...
does? (And there's no existing code available to do this?)

[kapishnikov, 2015/11/10 22:33:33]

I took it somewhere from stackoverflow.com. There are tests that verify these
regular expressions. I can add some more. My goal was to improve current host
validation that checks for the presence of "/" character. It is important to
have better validation since the C++ code responsible for adding the pins
silently fails without notifying the client when the host is invalid.

I will take a look at the code you referenced but at the first glance it looks
more complicated. There is Apache Common library that does it. It is a good
library and I wonder if we ever considered using it:
https://commons.apache.org/proper/commons-validator/apidocs/org/apache/common...
https://commons.apache.org/proper/commons-validator/apidocs/org/apache/common...

+            + "\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$";
+    private static final String VALID_HOST_EXPR = "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*"
+            + "[a-zA-Z0-9])\\.)*([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])$";
+    private static final Pattern VALID_IP_PATTERN = Pattern.compile(VALID_IP_EXPR);
+    private static final Pattern VALID_HOST_PATTERN = Pattern.compile(VALID_HOST_EXPR);
+
+    private CronetUtil() {}
+
+    /**
+     * Checks whether a given string that represents a host name is valid.
+     *
+     * @param hostName host name to check.
+     * @return true if the string is a valid host name.
+     */
+    static boolean isValidHostName(String hostName) {
+        String ascii = IDN.toASCII(hostName);

[mef, 2015/11/10 22:19:03]

maybe IDN.toASCII(src, IDN.USE_STD3_ASCII_RULES) to match
https://code.google.com/p/chromium/codesearch#chromium/src/url/android/java/s...

[kapishnikov, 2015/11/10 22:33:33]

I will add it.

+        return VALID_HOST_PATTERN.matcher(ascii).matches();
+    }
+
+    /**
+     * Checks whether a given string that represents an IPv4 address is valid.
+     *
+     * @param addr IPv4 address to check.
+     * @return true if the string is a valid IPv4 address.
+     */
+    static boolean isValidIPv4(String addr) {
+        return VALID_IP_PATTERN.matcher(addr).matches();
+    }
+}