Util: Update minidns to 1.1.1

from https://github.com/MiniDNS/minidns tag 1.1.1 2024-10-24

Possible fixes (unverified):
- MiniDNS per-RR parsers throw NegativeArraySizeException on malformed header
- DnsName.parse recurses per label without depth bound StackOverflow DoS
- DnsName parser throws AIOOBE (not IOException) on truncated pointer
- ipv4From / ipv6From resolve via DNS instead of parsing literals
- Question constructor uses assert for null checks
- DnsMessage pre-allocates ArrayLists from 16-bit header counts
- OPT.parse uses dis.read() and disabled assert for bounds

reported by: bottomlineit.co.za

core/java/src/org/minidns/constants/DnssecConstants.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/dnslabel/ALabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -14,7 +14,7 @@ import org.minidns.idna.MiniDnsIdna;
 
 public final class ALabel extends XnLabel {
 
-    protected ALabel(String label) {
+    ALabel(String label) {
         super(label);
     }
 

core/java/src/org/minidns/dnslabel/DnsLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -14,6 +14,8 @@ import java.io.ByteArrayOutputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.Locale;
 
+import org.minidns.util.SafeCharSequence;
+
 /**
  * A DNS label is an individual component of a DNS name. Labels are usually shown separated by dots.
  * <p>
@@ -29,7 +31,7 @@ import java.util.Locale;
  * @author Florian Schmaus
  *
  */
-public abstract class DnsLabel implements CharSequence, Comparable<DnsLabel> {
+public abstract class DnsLabel extends SafeCharSequence implements Comparable<DnsLabel> {
 
     /**
      * The maximum length of a DNS label in octets.
@@ -77,23 +79,27 @@ public abstract class DnsLabel implements CharSequence, Comparable<DnsLabel> {
         return getClass().getSimpleName();
     }
 
-    @Override
-    public final int length() {
-        return label.length();
-    }
-
-    @Override
-    public final char charAt(int index) {
-        return label.charAt(index);
-    }
-
-    @Override
-    public final CharSequence subSequence(int start, int end) {
-        return label.subSequence(start, end);
-    }
+    private transient String safeToStringRepresentation;
 
     @Override
     public final String toString() {
+        if (safeToStringRepresentation == null) {
+            safeToStringRepresentation = toSafeRepesentation(label);
+        }
+
+        return safeToStringRepresentation;
+    }
+
+    /**
+     * Get the raw label. Note that this may return a String containing null bytes.
+     * Those Strings are notoriously difficult to handle from a security
+     * perspective. Therefore it is recommended to use {@link #toString()} instead,
+     * which will return a sanitized String.
+     *
+     * @return the raw label.
+     * @since 1.1.0
+     */
+    public final String getRawLabel() {
         return label;
     }
 
@@ -170,10 +176,98 @@ public abstract class DnsLabel implements CharSequence, Comparable<DnsLabel> {
         return string.toLowerCase(Locale.US).startsWith("xn--");
     }
 
+    public static String toSafeRepesentation(String dnsLabel) {
+        if (consistsOnlyOfLettersDigitsHypenAndUnderscore(dnsLabel)) {
+            // This label is safe, nothing to do.
+            return dnsLabel;
+        }
+
+        StringBuilder sb = new StringBuilder(2 * dnsLabel.length());
+        for (int i = 0; i < dnsLabel.length(); i++) {
+            char c = dnsLabel.charAt(i);
+            if (isLdhOrMaybeUnderscore(c, true)) {
+                sb.append(c);
+                continue;
+            }
+
+
+            // Let's see if we found and unsafe char we want to replace.
+            switch (c) {
+            case '.':
+                sb.append('●'); // U+25CF BLACK CIRCLE;
+                break;
+            case '\\':
+                sb.append('⧷'); // U+29F7 REVERSE SOLIDUS WITH HORIZONTAL STROKE
+                break;
+            case '\u007f':
+                // Convert DEL to U+2421 SYMBOL FOR DELETE
+                sb.append('␡');
+                break;
+            case ' ':
+                sb.append('␣'); // U+2423 OPEN BOX
+                break;
+            default:
+                if (c < 32) {
+                    // First convert the ASCI control codes to the Unicode Control Pictures
+                    int substituteAsInt = c + '\u2400';
+                    assert substituteAsInt <= Character.MAX_CODE_POINT;
+                    char substitute = (char) substituteAsInt;
+                    sb.append(substitute);
+                } else if (c < 127) {
+                    // Everything smaller than 127 is now safe to directly append.
+                    sb.append(c);
+                } else if (c > 255) {
+                    throw new IllegalArgumentException("The string '" + dnsLabel
+                            + "' contains characters outside the 8-bit range: " + c + " at position " + i);
+                } else {
+                    // Everything that did not match the previous conditions is explicitly escaped.
+                    sb.append("〚"); // U+301A
+                    // Transform the char to hex notation. Note that we have ensure that c is <= 255
+                    // here, hence only two hexadecimal places are ok.
+                    String hex = String.format("%02X", (int) c);
+                    sb.append(hex);
+                    sb.append("〛"); // U+301B
+                }
+            }
+        }
+
+        return sb.toString();
+    }
+
+    private static boolean isLdhOrMaybeUnderscore(char c, boolean underscore) {
+            // CHECKSTYLE:OFF
+            return (c >= 'a' && c <= 'z')
+                    || (c >= 'A' && c <= 'Z')
+                    || (c >= '0' && c <= '9')
+                    || c == '-'
+                    || (underscore && c == '_')
+                    ;
+            // CHECKSTYLE:ON
+    }
+
+    private static boolean consistsOnlyOfLdhAndMaybeUnderscore(String string, boolean underscore) {
+        for (int i = 0; i < string.length(); i++) {
+            char c = string.charAt(i);
+            if (isLdhOrMaybeUnderscore(c, underscore)) {
+                continue;
+            }
+            return false;
+        }
+        return true;
+    }
+
+    public static boolean consistsOnlyOfLettersDigitsAndHypen(String string) {
+        return consistsOnlyOfLdhAndMaybeUnderscore(string, false);
+    }
+
+    public static boolean consistsOnlyOfLettersDigitsHypenAndUnderscore(String string) {
+        return consistsOnlyOfLdhAndMaybeUnderscore(string, true);
+    }
+
     public static class LabelToLongException extends IllegalArgumentException {
 
         /**
-         * 
+         *
          */
         private static final long serialVersionUID = 1L;
 

core/java/src/org/minidns/dnslabel/FakeALabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -12,7 +12,7 @@ package org.minidns.dnslabel;
 
 public final class FakeALabel extends XnLabel {
 
-    protected FakeALabel(String label) {
+    FakeALabel(String label) {
         super(label);
     }
 

core/java/src/org/minidns/dnslabel/LdhLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -11,9 +11,39 @@
 package org.minidns.dnslabel;
 
 /**
- * A LDH (<b>L</b>etters, <b>D</b>igits, <b>H</b>yphen) label, which is the classical label form.
- * 
- * @see <a href="https://tools.ietf.org/html/rfc5890#section-2.3.1">RFC 5890 § 2.3.1. LDH Label</a>
+ * A LDH (<b>L</b>etters, <b>D</b>igits, <b>H</b>yphen) label, which is the
+ * classical label form.
+ * <p>
+ * Note that it is a common misconception that LDH labels can not start with a
+ * digit. The origin of this misconception is likely that
+ * <a href="https://datatracker.ietf.org/doc/html/rfc1034#section-3.5">RFC 1034
+ * § 3.5</a> specified
+ * </p>
+ * <blockquote>
+ * They [i.e, DNS labels] must start with a letter, end with a letter or digit,
+ * and have as interior characters only letters, digits, and hyphen.
+ * </blockquote>.
+ * However, this was relaxed in
+ * <a href="https://datatracker.ietf.org/doc/html/rfc1123#page-13">RFC 1123 §
+ * 2.1</a>
+ * <blockquote>
+ * One aspect of host name syntax is hereby changed: the restriction on the first
+ * character is relaxed to allow either a letter or a digit.
+ * </blockquote>
+ * and later summarized in
+ * <a href="https://datatracker.ietf.org/doc/html/rfc3696#section-2">RFC 3696 §
+ * 2</a>:
+ * <blockquote>
+ * If the hyphen is used, it is not permitted to appear at either the beginning
+ * or end of a label.
+ * </blockquote>
+ * Furthermore
+ * <a href="https://datatracker.ietf.org/doc/html/rfc5890#section-2.3.1">RFC
+ * 5890 § 2.3.1</a> only mentions the requirement that hyphen must not be the
+ * first or last character of a LDH label.
+ *
+ * @see <a href="https://tools.ietf.org/html/rfc5890#section-2.3.1">RFC 5890 §
+ *      2.3.1. LDH Label</a>
  *
  */
 public abstract class LdhLabel extends DnsLabel {
@@ -31,17 +61,7 @@ public abstract class LdhLabel extends DnsLabel {
             return false;
         }
 
-        for (int i = 0; i < label.length(); i++) {
-            char c = label.charAt(i);
-            if ((c >= 'a' && c <= 'z')
-                    || (c >= 'A' && c <= 'Z')
-                    || (c >= '0' && c <= '9')
-                    || c == '-') {
-                continue;
-            }
-            return false;
-        }
-        return true;
+        return consistsOnlyOfLettersDigitsAndHypen(label);
     }
 
     protected static LdhLabel fromInternal(String label) {

core/java/src/org/minidns/dnslabel/LeadingOrTrailingHyphenLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -15,11 +15,11 @@ package org.minidns.dnslabel;
  */
 public final class LeadingOrTrailingHyphenLabel extends NonLdhLabel {
 
-    protected LeadingOrTrailingHyphenLabel(String label) {
+    LeadingOrTrailingHyphenLabel(String label) {
         super(label);
     }
 
-    protected static boolean isLeadingOrTrailingHypenLabelInternal(String label) {
+    static boolean isLeadingOrTrailingHypenLabelInternal(String label) {
         if (label.isEmpty()) {
             return false;
         }

core/java/src/org/minidns/dnslabel/NonLdhLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/dnslabel/NonReservedLdhLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -16,7 +16,7 @@ package org.minidns.dnslabel;
  */
 public final class NonReservedLdhLabel extends LdhLabel {
 
-    protected NonReservedLdhLabel(String label) {
+    NonReservedLdhLabel(String label) {
         super(label);
         assert isNonReservedLdhLabelInternal(label);
     }

core/java/src/org/minidns/dnslabel/OtherNonLdhLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -16,7 +16,7 @@ package org.minidns.dnslabel;
  */
 public final class OtherNonLdhLabel extends NonLdhLabel {
 
-    protected OtherNonLdhLabel(String label) {
+    OtherNonLdhLabel(String label) {
         super(label);
     }
 

core/java/src/org/minidns/dnslabel/ReservedLdhLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/dnslabel/UnderscoreLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -16,11 +16,11 @@ package org.minidns.dnslabel;
  */
 public final class UnderscoreLabel extends NonLdhLabel {
 
-    protected UnderscoreLabel(String label) {
+    UnderscoreLabel(String label) {
         super(label);
     }
 
-    protected static boolean isUnderscoreLabelInternal(String label) {
+    static boolean isUnderscoreLabelInternal(String label) {
         return label.charAt(0) == '_';
     }
 }

core/java/src/org/minidns/dnslabel/XnLabel.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -36,13 +36,15 @@ public abstract class XnLabel extends ReservedLdhLabel {
     }
 
     public static boolean isXnLabel(String label) {
-        if (!isLdhLabel(label)) {
+        if (!isReservedLdhLabel(label)) {
             return false;
         }
         return isXnLabelInternal(label);
     }
 
     static boolean isXnLabelInternal(String label) {
+        // Note that we already ensure the minimum label length here, since reserved LDH
+        // labels must start with "xn--".
         return label.substring(0, 2).toLowerCase(Locale.US).equals("xn");
     }
 }

core/java/src/org/minidns/dnsmessage/DnsMessage.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -170,6 +170,7 @@ public class DnsMessage {
          * Create a new opcode for a given byte value.
          *
          */
+        @SuppressWarnings("EnumOrdinal")
         OPCODE() {
             this.value = (byte) this.ordinal();
         }
@@ -675,7 +676,8 @@ public class DnsMessage {
      *
      * @return This message as a String suitable for terminal output.
      */
-    public String asTerminalOutput() {
+     @SuppressWarnings("JavaUtilDate")
+     public String asTerminalOutput() {
         if (terminalOutputCache != null) return terminalOutputCache;
 
         StringBuilder sb = new StringBuilder(";; ->>HEADER<<-")
@@ -1186,7 +1188,7 @@ public class DnsMessage {
         }
 
         /**
-         * Get the @{link EDNS} builder. If no builder has been set so far, then a new one will be created.
+         * Get the {@link Edns} builder. If no builder has been set so far, then a new one will be created.
          * <p>
          * The EDNS record can be used to announce the supported size of UDP payload as well as additional flags.
          * </p>
@@ -1194,7 +1196,7 @@ public class DnsMessage {
          * Note that some networks and firewalls are known to block big UDP payloads. 1280 should be a reasonable value,
          * everything below 512 is treated as 512 and should work on all networks.
          * </p>
-         * 
+         *
          * @return a EDNS builder.
          */
         public Edns.Builder getEdnsBuilder() {

core/java/src/org/minidns/dnsmessage/Question.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/dnsname/DnsName.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -22,9 +22,10 @@ import java.util.Locale;
 
 import org.minidns.dnslabel.DnsLabel;
 import org.minidns.idna.MiniDnsIdna;
+import org.minidns.util.SafeCharSequence;
 
 /**
- * A DNS name, also called "domain name". A DNS name consists of multiple 'labels' and is subject to certain restrictions (see
+ * A DNS name, also called "domain name". A DNS name consists of multiple 'labels' (see {@link DnsLabel}) and is subject to certain restrictions (see
  * for example <a href="https://tools.ietf.org/html/rfc3696#section-2">RFC 3696 § 2.</a>).
  * <p>
  * Instances of this class can be created by using {@link #from(String)}.
@@ -43,10 +44,11 @@ import org.minidns.idna.MiniDnsIdna;
  * </ul>
  *
  * @see <a href="https://tools.ietf.org/html/rfc3696">RFC 3696</a>
+ * @see DnsLabel
  * @author Florian Schmaus
  *
  */
-public final class DnsName implements CharSequence, Serializable, Comparable<DnsName> {
+public final class DnsName extends SafeCharSequence implements Serializable, Comparable<DnsName> {
 
     /**
      * 
@@ -59,7 +61,7 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
     private static final String LABEL_SEP_REGEX = "[.\u3002\uFF0E\uFF61]";
 
     /**
-     * @see <a href="https://tools.ietf.org/html/rfc1035">RFC 1035 § 2.3.4.</a>
+     * See <a href="https://tools.ietf.org/html/rfc1035">RFC 1035 § 2.3.4.</a>
      */
     static final int MAX_DNSNAME_LENGTH_IN_OCTETS = 255;
 
@@ -257,6 +259,31 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
         }
     }
 
+    /**
+     * Return the ACE (ASCII Compatible Encoding) version of this DNS name. Note
+     * that this method may return a String containing null bytes. Those Strings are
+     * notoriously difficult to handle from a security perspective. Therefore it is
+     * recommended to use {@link #toString()} instead, which will return a sanitized
+     * String.
+     *
+     * @return the ACE version of this DNS name.
+     * @since 1.1.0
+     */
+    public String getAce() {
+        return ace;
+    }
+
+    /**
+     * Returns the raw ACE version of this DNS name. That is, the version as it was
+     * received over the wire. Most notably, this version may include uppercase
+     * letters.
+     *
+     * <b>Please refer to {@link #getAce()} for a discussion of the security
+     * implications when working with the ACE representation of a DNS name.</b>
+     *
+     * @return the raw ACE version of this DNS name.
+     * @see #getAce()
+     */
     public String getRawAce() {
         return rawAce;
     }
@@ -291,7 +318,7 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
 
     public DnsLabel getHostpartLabel() {
         setLabelsIfRequired();
-        return labels[labels.length];
+        return labels[labels.length - 1];
     }
 
     private void setHostnameAndDomainpartIfRequired() {
@@ -317,24 +344,31 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
         return size;
     }
 
-    @Override
-    public int length() {
-        return ace.length();
-    }
-
-    @Override
-    public char charAt(int index) {
-        return ace.charAt(index);
-    }
-
-    @Override
-    public CharSequence subSequence(int start, int end) {
-        return ace.subSequence(start, end);
-    }
+    private transient String safeToStringRepresentation;
 
     @Override
     public String toString() {
-        return ace;
+        if (safeToStringRepresentation == null) {
+            setLabelsIfRequired();
+            if (labels.length == 0) {
+                return ".";
+            }
+
+            StringBuilder sb = new StringBuilder();
+            for (int i = labels.length - 1; i >= 0; i--) {
+                // Note that it is important that we append the result of DnsLabel.toString() to
+                // the StringBuilder. As only the result of toString() is the safe label
+                // representation.
+                String safeLabelRepresentation = labels[i].toString();
+                sb.append(safeLabelRepresentation);
+                if (i != 0) {
+                    sb.append('.');
+                }
+            }
+            safeToStringRepresentation = sb.toString();
+        }
+
+        return safeToStringRepresentation;
     }
 
     public static DnsName from(CharSequence name) {
@@ -367,12 +401,17 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
         return new DnsName(rawLabels, true);
     }
 
+    public static DnsName from(CharSequence child, DnsName parent) {
+        DnsLabel childLabel = DnsLabel.from(child.toString());
+        return DnsName.from(childLabel, parent);
+    }
+
     public static DnsName from(DnsLabel child, DnsName parent) {
         parent.setLabelsIfRequired();
 
         DnsLabel[] rawLabels = new DnsLabel[parent.rawLabels.length + 1];
         System.arraycopy(parent.rawLabels, 0, rawLabels, 0, parent.rawLabels.length);
-        rawLabels[rawLabels.length] = child;
+        rawLabels[parent.rawLabels.length] = child;
         return new DnsName(rawLabels, true);
     }
 
@@ -450,6 +489,7 @@ public final class DnsName implements CharSequence, Serializable, Comparable<Dns
      * @return The parsed domain name.
      * @throws IllegalStateException on cycles.
      */
+     @SuppressWarnings("NonApiType")
     private static DnsName parse(byte[] data, int offset, HashSet<Integer> jumps)
             throws IllegalStateException {
         int c = data[offset] & 0xff;

core/java/src/org/minidns/dnsname/InvalidDnsNameException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/edns/Edns.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -129,7 +129,7 @@ public class Edns {
         }
     }
 
-    @SuppressWarnings("unchecked")
+    @SuppressWarnings({"unchecked", "TypeParameterUnusedInFormals"})
     public <O extends EdnsOption> O getEdnsOption(OptionCode optionCode) {
         for (EdnsOption o : variablePart) {
             if (o.getOptionCode().equals(optionCode)) {

core/java/src/org/minidns/edns/EdnsOption.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -28,6 +28,7 @@ public abstract class EdnsOption {
         this.optionData = optionData;
     }
 
+    @SuppressWarnings("this-escape")
     protected EdnsOption(byte[] optionData) {
         this.optionCode = getOptionCode().asInt;
         this.optionLength = optionData.length;

core/java/src/org/minidns/edns/Nsid.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/edns/UnknownEdnsOption.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/idna/DefaultIdnaTransformator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/idna/IdnaTransformator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/idna/MiniDnsIdna.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/package-info.java

@@ -1,8 +1,8 @@
 /**
- * This is a portion of release 1.0.0 of MiniDNS from https://github.com/MiniDNS/minidns/ 2020-07-18
+ * This is a portion of release 1.1.1 of MiniDNS from https://github.com/MiniDNS/minidns/ 2024-10-24
  * Only contains the minidns-core portion of the library.
  * Removed tests, most util classes, and DnsRootServer class.
- * 
+ *
  * This software may be used under the terms of (at your choice)
  * - LGPL version 2 (or later) (see LICENSE-LGPLv2.1 for details)
  * - Apache Software licence (see LICENSE-APACHE2.0 for details)

core/java/src/org/minidns/record/A.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/AAAA.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/CNAME.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/DLV.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/DNAME.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/DNSKEY.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -102,7 +102,7 @@ public class DNSKEY extends Data {
     }
 
     public DNSKEY(short flags, byte protocol, byte algorithm, byte[] key) {
-        this(flags, protocol, SignatureAlgorithm.forByte(algorithm), key);
+        this(flags, protocol, SignatureAlgorithm.forByte(algorithm), algorithm, key);
     }
 
     public DNSKEY(short flags, byte protocol, SignatureAlgorithm algorithm, byte[] key) {
@@ -140,7 +140,7 @@ public class DNSKEY extends Data {
     public void serialize(DataOutputStream dos) throws IOException {
         dos.writeShort(flags);
         dos.writeByte(protocol);
-        dos.writeByte(algorithm.number);
+        dos.writeByte(algorithmByte);
         dos.write(key);
     }
 

core/java/src/org/minidns/record/DS.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/Data.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/DelegatingDnssecRR.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -15,6 +15,7 @@ import java.io.DataOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.util.Arrays;
+import java.util.Locale;
 
 import org.minidns.constants.DnssecConstants.DigestAlgorithm;
 import org.minidns.constants.DnssecConstants.SignatureAlgorithm;
@@ -74,10 +75,10 @@ public abstract class DelegatingDnssecRR extends Data {
     }
 
     protected static final class SharedData {
-        protected final int keyTag;
-        protected final byte algorithm;
-        protected final byte digestType;
-        protected final byte[] digest;
+        final int keyTag;
+        final byte algorithm;
+        final byte digestType;
+        final byte[] digest;
 
         private SharedData(int keyTag, byte algorithm, byte digestType, byte[] digest) {
             this.keyTag = keyTag;
@@ -128,7 +129,7 @@ public abstract class DelegatingDnssecRR extends Data {
                 .append(keyTag).append(' ')
                 .append(algorithm).append(' ')
                 .append(digestType).append(' ')
-                .append(new BigInteger(1, digest).toString(16).toUpperCase());
+                .append(new BigInteger(1, digest).toString(16).toUpperCase(Locale.ROOT));
         return sb.toString();
     }
 
@@ -145,7 +146,7 @@ public abstract class DelegatingDnssecRR extends Data {
 
     public String getDigestHex() {
         if (digestHexCache == null) {
-            digestHexCache = getDigestBigInteger().toString(16).toUpperCase();
+            digestHexCache = getDigestBigInteger().toString(16).toUpperCase(Locale.ROOT);
         }
         return digestHexCache;
     }

core/java/src/org/minidns/record/InternetAddressRR.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/MX.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/NS.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/NSEC.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -110,7 +110,7 @@ public class NSEC extends Data {
                 }
                 int a = (type >> 3) % 32;
                 int b = type % 8;
-                bitmap[a] |= 128 >> b;
+                bitmap[a] |= (byte) (128 >> b);
             }
             if (windowBlock != -1) writeOutBlock(bitmap, dos);
         } catch (IOException e) {

core/java/src/org/minidns/record/NSEC3.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -21,6 +21,7 @@ import java.math.BigInteger;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 
 /**
@@ -166,7 +167,7 @@ public class NSEC3 extends Data {
                 .append(hashAlgorithm).append(' ')
                 .append(flags).append(' ')
                 .append(iterations).append(' ')
-                .append(salt.length == 0 ? "-" : new BigInteger(1, salt).toString(16).toUpperCase()).append(' ')
+                .append(salt.length == 0 ? "-" : new BigInteger(1, salt).toString(16).toUpperCase(Locale.ROOT)).append(' ')
                 .append(Base32.encodeToString(nextHashed));
         for (TYPE type : types) {
             sb.append(' ').append(type);

core/java/src/org/minidns/record/NSEC3PARAM.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -17,6 +17,7 @@ import java.io.DataInputStream;
 import java.io.DataOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.util.Locale;
 
 /**
  * NSEC3PARAM record payload.
@@ -91,7 +92,7 @@ public class NSEC3PARAM extends Data {
                 .append(hashAlgorithm).append(' ')
                 .append(flags).append(' ')
                 .append(iterations).append(' ')
-                .append(salt.length == 0 ? "-" : new BigInteger(1, salt).toString(16).toUpperCase());
+                .append(salt.length == 0 ? "-" : new BigInteger(1, salt).toString(16).toUpperCase(Locale.ROOT));
         return sb.toString();
     }
 

core/java/src/org/minidns/record/OPENPGPKEY.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/OPT.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/PTR.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/RRSIG.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -78,6 +78,7 @@ public class RRSIG extends Data {
      */
     private final byte[] signature;
 
+    @SuppressWarnings("JavaUtilDate")
     public static RRSIG parse(DataInputStream dis, byte[] data, int length) throws IOException {
         TYPE typeCovered = TYPE.getType(dis.readUnsignedShort());
         byte algorithm = dis.readByte();
@@ -167,6 +168,7 @@ public class RRSIG extends Data {
         dos.write(signature);
     }
 
+    @SuppressWarnings("JavaUtilDate")
     public void writePartialSignature(DataOutputStream dos) throws IOException {
         dos.writeShort(typeCovered.getValue());
         dos.writeByte(algorithmByte);

core/java/src/org/minidns/record/RRWithTarget.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/Record.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -484,8 +484,8 @@ public final class Record<D extends Data> {
      * @return True if this record is a valid answer.
      */
     public boolean isAnswer(Question q) {
-        return ((q.type == type) || (q.type == TYPE.ANY)) &&
-               ((q.clazz == clazz) || (q.clazz == CLASS.ANY)) &&
+        return (q.type == type || q.type == TYPE.ANY) &&
+               (q.clazz == clazz || q.clazz == CLASS.ANY) &&
                q.name.equals(name);
     }
 

core/java/src/org/minidns/record/SOA.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/record/SRV.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -20,7 +20,7 @@ import org.minidns.record.Record.TYPE;
 /**
  * SRV record payload (service pointer).
  */
-public class SRV extends Data implements Comparable<SRV> {
+public class SRV extends RRWithTarget implements Comparable<SRV> {
 
     /**
      * The priority of this service. Lower values mean higher priority.
@@ -38,38 +38,24 @@ public class SRV extends Data implements Comparable<SRV> {
      */
     public final int port;
 
-    /**
-     * The target server.
-     */
-    public final DnsName target;
-
-    /**
-     * The target server.
-     *
-     * @deprecated use {@link #target} instead.
-     */
-    @Deprecated
-    public final DnsName name;
-
     public static SRV parse(DataInputStream dis, byte[] data)
         throws IOException {
         int priority = dis.readUnsignedShort();
         int weight = dis.readUnsignedShort();
         int port = dis.readUnsignedShort();
-        DnsName name = DnsName.parse(dis, data);
-        return new SRV(priority, weight, port, name);
+        DnsName target = DnsName.parse(dis, data);
+        return new SRV(priority, weight, port, target);
     }
 
-    public SRV(int priority, int weight, int port, String name) {
-        this(priority, weight, port, DnsName.from(name));
+    public SRV(int priority, int weight, int port, String target) {
+        this(priority, weight, port, DnsName.from(target));
     }
 
-    public SRV(int priority, int weight, int port, DnsName name) {
+    public SRV(int priority, int weight, int port, DnsName target) {
+        super(target);
         this.priority = priority;
         this.weight = weight;
         this.port = port;
-        this.target = name;
-        this.name = target;
     }
 
     /**
@@ -90,7 +76,7 @@ public class SRV extends Data implements Comparable<SRV> {
         dos.writeShort(priority);
         dos.writeShort(weight);
         dos.writeShort(port);
-        target.writeToStream(dos);
+        super.serialize(dos);
     }
 
     @Override

core/java/src/org/minidns/record/TLSA.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -22,11 +22,55 @@ public class TLSA extends Data {
 
     private static final Map<Byte, CertUsage> CERT_USAGE_LUT = new HashMap<>();
 
+    /**
+     * The certificate usage field.
+     *
+     * @see <a href="https://tools.ietf.org/html/rfc6698#section-2.1.1">RFC 6698 § 2.1.1</a>
+     *
+     */
     public enum CertUsage {
 
+        /**
+         * The given <b>CA</b> certificate (or its public key) MUST be found in at least
+         * one PKIX path to the end entity certificate.
+         *
+         * <p>
+         * PKIX-TA(0)
+         * </p>
+         */
         caConstraint((byte) 0),
+
+        /**
+         * The given certificate (or its public key) MUST match the end entity
+         * certificate and MUST pass PKIX validation. Note that the requirement to pass
+         * PKIX validation is what makes this different from
+         * {@link #domainIssuedCertificate}.
+         *
+         * <p>
+         * PKIX-EE(1)
+         * </p>
+         */
         serviceCertificateConstraint((byte) 1),
+
+        /**
+         * The given certificate (or its public key) MUST be used as trust anchor when
+         * validating the end entity certificate.
+         *
+         * <p>
+         * DANE-TA(2)
+         * </p>
+         */
         trustAnchorAssertion((byte) 2),
+
+        /**
+         * The given certificate (or its public key) MUST match the end entity
+         * certificate. Unlike {@link #serviceCertificateConstraint}, this does not
+         * require PKIX validation.
+         *
+         * <p>
+         * DANE-EE(3)
+         * </p>
+         */
         domainIssuedCertificate((byte) 3),
         ;
 
@@ -140,6 +184,7 @@ public class TLSA extends Data {
     }
 
     @Override
+    @SuppressWarnings("UnnecessaryStringBuilder")
     public String toString() {
         return new StringBuilder()
                 .append(certUsageByte).append(' ')

core/java/src/org/minidns/record/TXT.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")
@@ -13,7 +13,7 @@ package org.minidns.record;
 import java.io.DataInputStream;
 import java.io.DataOutputStream;
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -69,11 +69,7 @@ public class TXT extends Data {
             List<byte[]> extents = getExtents();
             List<String> characterStrings = new ArrayList<>(extents.size());
             for (byte[] extent : extents) {
-                try {
-                    characterStrings.add(new String(extent, "UTF-8"));
-                } catch (UnsupportedEncodingException e) {
-                    throw new AssertionError(e);
-                }
+                characterStrings.add(new String(extent, StandardCharsets.UTF_8));
             }
 
             characterStringsCache = Collections.unmodifiableList(characterStrings);

core/java/src/org/minidns/record/UNKNOWN.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/util/Base32.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/util/Base64.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/util/Hex.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/util/InetAddressUtil.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2015-2020 the original author or authors
+ * Copyright 2015-2024 the original author or authors
  *
  * This software is licensed under the Apache License, Version 2.0,
  * the GNU Lesser General Public License version 2 or later ("LGPL")

core/java/src/org/minidns/util/SafeCharSequence.java

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2015-2024 the original author or authors
+ *
+ * This software is licensed under the Apache License, Version 2.0,
+ * the GNU Lesser General Public License version 2 or later ("LGPL")
+ * and the WTFPL.
+ * You may choose either license to govern your use of this software only
+ * upon the condition that you accept all of the terms of either
+ * the Apache License 2.0, the LGPL 2.1+ or the WTFPL.
+ */
+package org.minidns.util;
+
+public class SafeCharSequence implements CharSequence {
+
+    @Override
+    public final int length() {
+        return toSafeString().length();
+    }
+
+    @Override
+    public final char charAt(int index) {
+        return toSafeString().charAt(index);
+    }
+
+    @Override
+    public final CharSequence subSequence(int start, int end) {
+        return toSafeString().subSequence(end, end);
+    }
+
+    public String toSafeString() {
+        // The default implementation assumes that toString() returns a safe
+        // representation. Subclasses may override toSafeString() if this assumption is
+        // not correct.
+        return toString();
+    }
+}