Language: Java
Label: vulnerable
CWE: NVD-CWE-noinfo \u2014 

Code:
    private static RequestTarget slowAbsoluteFormForClient(String reqTarget, int authorityPos) {
        // Extract scheme and authority while looking for path.
        final URI schemeAndAuthority;
        final String scheme = reqTarget.substring(0, authorityPos - 3);
        final int nextPos = findNextComponent(reqTarget, authorityPos);
        final String authority;
        if (nextPos < 0) {
            // Found no other components after authority
            authority = reqTarget.substring(authorityPos);
        } else {
            // Path, query or fragment exists.
            authority = reqTarget.substring(authorityPos, nextPos);
        }

        // Reject a URI with an empty authority.
        if (authority.isEmpty()) {
            return null;
        }

        // Normalize scheme and authority.
        schemeAndAuthority = normalizeSchemeAndAuthority(scheme, authority);
        if (schemeAndAuthority == null) {
            // Invalid scheme or authority.
            return null;
        }

        if (nextPos < 0) {
            return new DefaultRequestTarget(RequestTargetForm.ABSOLUTE,
                                            schemeAndAuthority.getScheme(),
                                            schemeAndAuthority.getRawAuthority(),
                                            "/",
                                            null,
                                            null);
        }

        return slowForClient(reqTarget, schemeAndAuthority, nextPos);
    }