Language: Java
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    protected AbstractRequestContextBuilder(boolean server, RpcRequest rpcReq, URI uri) {
        this.server = server;
        req = null;
        this.rpcReq = requireNonNull(rpcReq, "rpcReq");
        method = HttpMethod.POST;

        requireNonNull(uri, "uri");
        authority = firstNonNull(uri.getRawAuthority(), FALLBACK_AUTHORITY);
        sessionProtocol = getSessionProtocol(uri);

        if (server) {
            reqTarget = DefaultRequestTarget.createWithoutValidation(
                    RequestTargetForm.ORIGIN, null, null,
                    uri.getRawPath(), uri.getRawQuery(), null);
        } else {
            reqTarget = DefaultRequestTarget.createWithoutValidation(
                    RequestTargetForm.ORIGIN, null, null,
                    uri.getRawPath(), uri.getRawQuery(), uri.getRawFragment());
        }
    }