JCL-431: Improve containment validation

solid/src/main/java/com/inrupt/client/solid/SolidContainer.java

@@ -82,9 +82,9 @@ public SolidContainer(final URI identifier, final Dataset dataset, final Metadat
      * @return the contained resources
      */
     public Set<SolidResource> getResources() {
-        final String container = normalize(getIdentifier());
         // As defined by the Solid Protocol, containers always end with a slash.
-        if (container.endsWith("/")) {
+        if (getIdentifier().getPath().endsWith("/")) {
+            final String container = normalize(getIdentifier());
             final Node node = new Node(rdf.createIRI(getIdentifier().toString()), getGraph());
             try (final Stream<Node.TypedNode> stream = node.getResources()) {
                 return stream.filter(child -> verifyContainmentIri(container, child)).map(child -> {
@@ -100,14 +100,14 @@ public Set<SolidResource> getResources() {
 
     @Override
     public ValidationResult validate() {
-        // Get the normalized container URI
-        final String container = normalize(getIdentifier());
         final List<String> messages = new ArrayList<>();
         // Verify that the container URI path ends with a slash
-        if (!container.endsWith("/")) {
+        if (!getIdentifier().getPath().endsWith("/")) {
             messages.add("Container URI does not end in a slash");
         }
 
+        // Get the normalized container URI
+        final String container = normalize(getIdentifier());
         // Verify that all ldp:contains triples align with Solid expectations
         getGraph().stream(null, rdf.createIRI(LDP.contains.toString()), null)
             .collect(Collectors.partitioningBy(verifyContainmentTriple(container)))
@@ -121,10 +121,6 @@ public ValidationResult validate() {
         return new ValidationResult(false, messages);
     }
 
-    static String normalize(final IRI iri) {
-        return normalize(URI.create(iri.getIRIString()));
-    }
-
     static String normalize(final URI uri) {
         return uri.normalize().toString().split("#")[0].split("\\?")[0];
     }
@@ -145,22 +141,43 @@ static Predicate<Triple> verifyContainmentTriple(final String container) {
     }
 
     static boolean verifyContainmentIri(final String container, final IRI object) {
-        if (!object.getIRIString().startsWith(container)) {
-            // Out-of-domain containment triple object
+
+        // 1 URI Structure Tests
+        final URI normalized = URI.create(object.getIRIString()).normalize();
+
+        // 1.A Query strings are not allowed in object URI
+        if (normalized.getQuery() != null) {
+            return false;
+        }
+
+        // 1.B URI fragments are not allowed in object URI
+        if (normalized.getFragment() != null) {
+            return false;
+        }
+
+        // 2 Relative path tests
+        final URI base = URI.create(container).normalize();
+        final URI relative = base.relativize(normalized);
+
+        // 2.A Base URI cannot equal the object URI
+        if (base.equals(normalized)) {
+            return false;
+        }
+
+        // 2.B Object URI must be relative to (contained in) the base URI
+        if (relative.isAbsolute()) {
             return false;
-        } else {
-            final String relativePath = object.getIRIString().substring(container.length());
-            final String normalizedPath = relativePath.endsWith("/") ?
-                relativePath.substring(0, relativePath.length() - 1) : relativePath;
-            if (normalizedPath.isEmpty()) {
-                // Containment triple subject and object cannot be the same
-                return false;
-            }
-            if (normalizedPath.contains("/")) {
-                // Containment cannot skip intermediate nodes
-                return false;
-            }
         }
+
+        final String relativePath = relative.getPath();
+        final String normalizedPath = relativePath.endsWith("/") ?
+            relativePath.substring(0, relativePath.length() - 1) : relativePath;
+
+        // 2.C Containment cannot skip intermediate nodes
+        if (normalizedPath.contains("/")) {
+            return false;
+        }
+
         return true;
     }
 

solid/src/test/java/com/inrupt/client/solid/SolidRDFSourceTest.java

@@ -194,6 +194,25 @@ void testEmptyContentType() {
         }
     }
 
+    @Test
+    void testNonContainer() {
+        final URI resource = URI.create(config.get("solid_resource_uri") + "/recipe");
+        final Request request = Request.newBuilder()
+            .uri(resource)
+            .header("Accept", "text/turtle")
+            .GET()
+            .build();
+
+        final Response<SolidContainer> response = client.send(request, SolidResourceHandlers.ofSolidContainer())
+            .toCompletableFuture().join();
+
+        try (final SolidContainer container = response.body()) {
+            assertEquals(resource, container.getIdentifier());
+            assertTrue(container.getResources().isEmpty());
+            assertFalse(container.validate().isValid());
+        }
+    }
+
     @Test
     void testInvalidRdf() {
         final URI resource = URI.create(config.get("solid_resource_uri") + "/nonRDF");

solid/src/test/resources/__files/container.ttl

@@ -19,7 +19,9 @@
 
 # These containment triples should not be included in a getResources response
 <>
-    ldp:contains <https://example.com/other> , <newContainer/child> , <> , <./> .
+    ldp:contains <https://example.com/other> , <newContainer/child> , <> , <./> ,
+    <?foo> , <#bar> , <?foo#bar> , <./?foo> , <./#bar> , <./?foo#bar> ,
+    <../?foo> , <../#bar> , <../?foo#bar> , <child?foo> , <child#bar> , <child?foo#bar> .
 <https://example.test/container/>
     a ldp:BasicContainer ;
     ldp:contains <https://example.test/container/external> .