fix: support glob wildcards in noProxyAddresses and prevent PatternSyntaxException crash - #1809
Open
xuchuwan wants to merge 1 commit into
Open
fix: support glob wildcards in noProxyAddresses and prevent PatternSyntaxException crash#1809xuchuwan wants to merge 1 commit into
xuchuwan wants to merge 1 commit into
Conversation
MikeDombo
reviewed
Jun 25, 2026
|
|
||
| try { | ||
| return endpoint.matches(regex); | ||
| } catch (PatternSyntaxException e) { |
Member
There was a problem hiding this comment.
Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.
Problem: An exception is being logged incorrectly.
Fix: Set the original exception as the cause of the log statement. Otherwise, you will lose the stack trace and message of the original exception, which will make it difficult to analyze the event that caused the exception.
Learn more
Suggested remediation:
Pass the caught exceptions to the logs to retain the original exception message and the stack trace.
@@ -484,3 +484,3 @@
} catch (PatternSyntaxException e) {
- logger.warn("Invalid noProxyAddress pattern '{}', skipping: {}", pattern, e.getMessage());
+ logger.warn("Invalid noProxyAddress pattern '{}', skipping: {}", pattern, e.getMessage(), e);
return false;
|
Unit Tests Coverage Report
Minimum allowed coverage is Generated by 🐒 cobertura-action against 787da98 |
|
Integration Tests Coverage Report
Minimum allowed coverage is Generated by 🐒 cobertura-action against 787da98 |
xuchuwan
force-pushed
the
fix/noproxy-wildcard-support
branch
from
June 25, 2026 23:34
529d4c6 to
4b719d8
Compare
MikeDombo
reviewed
Jun 25, 2026
|
|
||
| try { | ||
| return endpoint.matches(regex); | ||
| } catch (PatternSyntaxException e) { |
Member
There was a problem hiding this comment.
Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.
Problem: An exception is being logged incorrectly.
Fix: Set the original exception as the cause of the log statement. Otherwise, you will lose the stack trace and message of the original exception, which will make it difficult to analyze the event that caused the exception.
Learn more
Suggested remediation:
Pass the caught exceptions to the logs to retain the original exception message and the stack trace.
@@ -523,3 +523,3 @@
} catch (PatternSyntaxException e) {
- logger.warn("Invalid noProxyAddress pattern '{}', skipping: {}", pattern, e.getMessage());
+ logger.warn("Invalid noProxyAddress pattern '{}', skipping: {}", pattern, e.getMessage(), e);
return false;
…ntaxException crash noProxyAddresses entries like '*.sts.amazon.com' cause PatternSyntaxException because MqttClient.java and StandaloneMqttConnector.java use String.matches() which interprets patterns as Java regex. The '*' quantifier with no preceding character is invalid regex, causing uncaught exceptions that kill MQTT connectivity. This commit: - Adds ProxyUtils.noProxyMatches() that converts standard NO_PROXY glob patterns (*.domain.com, .domain.com) to proper regex before matching - Wraps matching in try-catch for defense-in-depth against any remaining edge cases - Replaces endpoint::matches at both call sites with the new helper - Adds tests for wildcard prefix, leading-dot, exact match, and invalid patterns This aligns MQTT/CRT proxy bypass behavior with the SDK HTTP path (ProxyConfiguration.nonProxyHosts()) which already handles wildcards natively.
xuchuwan
force-pushed
the
fix/noproxy-wildcard-support
branch
from
June 25, 2026 23:51
4b719d8 to
787da98
Compare
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
noProxyAddressesentries with standard NO_PROXY glob patterns (e.g.*.sts.amazon.com) crash Nucleus withPatternSyntaxException: Dangling meta character '*'. The crash kills all MQTT connectivity (Shadow, Jobs, Spooler, IPC) and the device becomes permanently unreachable since the config persists across restart.Root cause:
MqttClient.java:255andStandaloneMqttConnector.java:129useendpoint::matcheswhich is Java'sString.matches(regex).*.domain.comis invalid regex — the*quantifier has no preceding character.Note: The AWS SDK HTTP path (
ProxyConfiguration.nonProxyHosts()) already handles wildcards natively. Only the MQTT/CRT paths crash.Fix
Added
ProxyUtils.noProxyMatches(endpoint, pattern)that converts standard NO_PROXY glob patterns to proper regex before matching:*.domain.com→.*\Q.domain.com\E(wildcard subdomain).domain.com→.*\Q.domain.com\E(leading-dot convention, same as*.)domain.com→\Qdomain.com\E(exact match, dots are literal)Replaced
endpoint::matchesat both call sites with the new helper.Validation
1. Reproduced the crash (before fix):
2. Verified fix in Docker container (Nucleus 2.17.0, Java 11):
After patching
ProxyUtils.classin the Greengrass.jar and restarting Nucleus with the same wildcard config:Comparison — same config, unpatched Nucleus (6 crashes at 20:38:19 vs 0 crashes at 22:25:20 after patch).
3. Logic validation (compiled and run inside container):
3. Unit tests: 20/20 pass (15 existing + 5 new covering wildcard, leading-dot, exact, invalid, and dot-literal cases).
Changes
ProxyUtils.javanoProxyMatches()with glob→regex conversion + try-catchMqttClient.javaendpoint::matcheswithProxyUtils.noProxyMatches()StandaloneMqttConnector.javaProxyUtilsTest.java4 files changed, +88 −2.