Stronger URL validation in manual server (#6231)

Author: TimoPtr

app/src/main/kotlin/io/homeassistant/companion/android/onboarding/manualserver/ManualServerViewModel.kt

@@ -3,6 +3,7 @@ package io.homeassistant.companion.android.onboarding.manualserver
 import android.webkit.URLUtil
 import androidx.lifecycle.ViewModel
 import dagger.hilt.android.lifecycle.HiltViewModel
+import java.net.URL
 import javax.inject.Inject
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -23,7 +24,7 @@ internal class ManualServerViewModel @Inject constructor() : ViewModel() {
 
     private fun validateServerUrl(url: String) {
         isServerUrlValidMutableFlow.update {
-            URLUtil.isValidUrl(url)
+            URLUtil.isValidUrl(url) && runCatching { URL(url) }.isSuccess
         }
     }
 }

app/src/test/kotlin/io/homeassistant/companion/android/onboarding/manualserver/ManualServerViewModelTest.kt

@@ -63,6 +63,26 @@ class ManualServerViewModelTest {
         }
     }
 
+    @Test
+    fun `Given url with malformed port when onServerUrlChange then isServerUrlValid is false`() = runTest {
+        val malformedUrl = "http://homeassistant.local::8123"
+
+        turbineScope {
+            val serverUrlFlow = viewModel.serverUrlFlow.testIn(backgroundScope)
+            val isServerUrlValidFlow = viewModel.isServerUrlValidFlow.testIn(backgroundScope)
+            assertEquals("", serverUrlFlow.awaitItem())
+            assertFalse(isServerUrlValidFlow.awaitItem())
+
+            // URLUtil may return true but java.net.URL parsing should fail
+            mockUrlUtilIsValidUrl(true)
+
+            viewModel.onServerUrlChange(malformedUrl)
+
+            isServerUrlValidFlow.expectNoEvents()
+            assertEquals(malformedUrl, serverUrlFlow.awaitItem())
+        }
+    }
+
     private fun mockUrlUtilIsValidUrl(isValid: Boolean) {
         mockkStatic(URLUtil::class)
         every { URLUtil.isValidUrl(any()) } returns isValid