SEC-1802: Add digits to valid URL scheme regex.

web/src/main/java/org/springframework/security/web/util/UrlUtils.java

@@ -129,7 +129,7 @@ public final class UrlUtils {
      * Decides if a URL is absolute based on whether it contains a valid scheme name, as defined in RFC 1738.
      */
     public static boolean isAbsoluteUrl(String url) {
-        final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z.+-]+://.*", Pattern.CASE_INSENSITIVE);
+        final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z0-9.+-]+://.*", Pattern.CASE_INSENSITIVE);
 
         return ABSOLUTE_URL.matcher(url).matches();
     }

web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java

@@ -13,6 +13,7 @@ public class UrlUtilsTests {
     @Test
     public void absoluteUrlsAreMatchedAsAbsolute() throws Exception {
         assertTrue(UrlUtils.isAbsoluteUrl("http://something/"));
+        assertTrue(UrlUtils.isAbsoluteUrl("http1://something/"));
         assertTrue(UrlUtils.isAbsoluteUrl("HTTP://something/"));
         assertTrue(UrlUtils.isAbsoluteUrl("https://something/"));
         assertTrue(UrlUtils.isAbsoluteUrl("a://something/"));