fix(ssrf): block unparseable host notations and add bypass tests

- Reject URLs where URI.getHost() is null but URI.getAuthority() is
  non-null: this covers octal (0251.0376.0251.0376) and Unicode digit
  hosts that java.net.URI cannot parse into a standard hostname. Without
  this guard, octal-encoded private IPs pass validation entirely.
- Use authority != null instead of StringUtils.hasText() — getAuthority()
  is never an empty string, so the plain null-check is exact and clearer.
- Add BypassAttempts test class covering: decimal-encoded IPs (resolved
  correctly by InetAddress), octal and Unicode (caught by the new guard),
  and uppercase scheme normalisation (SBA's own toLowerCase logic).
  Tests that only exercise JDK URI parsing or Spring Boot's InetAddressFilter
  internals were not added — those are tested by their respective owners.

Author: SteKoe

spring-boot-admin-server/src/main/java/de/codecentric/boot/admin/server/utils/SsrfUrlValidator.java

@@ -91,7 +91,17 @@ public void validate(@Nullable String url) {
 		}
 
 		checkScheme(url, uri.getScheme());
-		checkAddress(url, uri.getHost());
+
+		String host = uri.getHost();
+		// If the URI has an authority component but getHost() returned null, the host
+		// literal could not be parsed as a standard hostname or IP by java.net.URI
+		// (e.g. octal notation "0251.0376.0251.0376", Unicode digits). Reject it —
+		// we cannot safely validate what we cannot parse.
+		if (host == null && uri.getAuthority() != null) {
+			throw new SsrfProtectionException("URL '" + url
+					+ "' contains a host that cannot be parsed and validated. Rejecting to prevent bypass.");
+		}
+		checkAddress(url, host);
 	}
 
 	private void checkScheme(String url, @Nullable String scheme) {

spring-boot-admin-server/src/test/java/de/codecentric/boot/admin/server/utils/SsrfUrlValidatorTest.java

@@ -83,6 +83,59 @@ void allows_publicUrls(String url) {
 		assertThatCode(() -> validator.validate(url)).doesNotThrowAnyException();
 	}
 
+	// -------------------------------------------------------------------------
+	// URL encoding / notation bypass attempts
+	// -------------------------------------------------------------------------
+
+	@Nested
+	class BypassAttempts {
+
+		@Test
+		void blocks_decimalEncodedPrivateIp() {
+			// 169.254.169.254 expressed as a single 32-bit decimal integer.
+			// java.net.URI parses "2852039166" as a hostname; InetAddress resolves
+			// it to the link-local metadata address. Verifies SBA relies correctly
+			// on InetAddress resolution rather than string matching.
+			assertThatThrownBy(() -> validator.validate("http://2852039166/latest/meta-data"))
+				.isInstanceOf(SsrfProtectionException.class);
+		}
+
+		@Test
+		void blocks_decimalEncodedLoopback() {
+			// 127.0.0.1 as a 32-bit decimal integer (2130706433).
+			assertThatThrownBy(() -> validator.validate("http://2130706433/"))
+				.isInstanceOf(SsrfProtectionException.class);
+		}
+
+		@Test
+		void rejects_octalEncodedPrivateIp() {
+			// 0251.0376.0251.0376 is octal for 169.254.169.254.
+			// java.net.URI cannot parse octal notation and returns host=null with a
+			// non-null authority — rejected to prevent bypass.
+			assertThatThrownBy(() -> validator.validate("http://0251.0376.0251.0376/"))
+				.isInstanceOf(SsrfProtectionException.class)
+				.hasMessageContaining("cannot be parsed and validated");
+		}
+
+		@Test
+		void rejects_unicodeDigitHost() {
+			// Unicode digit characters that look like "127.0.0.1" — URI returns
+			// host=null with a non-null authority, so we reject rather than skip.
+			assertThatThrownBy(() -> validator.validate("http://①②⑦.0.0.1/"))
+				.isInstanceOf(SsrfProtectionException.class)
+				.hasMessageContaining("cannot be parsed and validated");
+		}
+
+		@Test
+		void blocks_schemeCaseVariant_upper() {
+			// HTTP:// (uppercase) must still be normalised and blocked when pointing
+			// to a private address — SBA's checkScheme() uses scheme.toLowerCase().
+			assertThatThrownBy(() -> validator.validate("HTTP://127.0.0.1/"))
+				.isInstanceOf(SsrfProtectionException.class);
+		}
+
+	}
+
 	// -------------------------------------------------------------------------
 	// Scheme checks
 	// -------------------------------------------------------------------------