Ensure scheme not lowercased if URI variable

Closes gh-33699

Author: rstoyanchev

Diff for: spring-web/src/main/java/org/springframework/web/util/RfcUriParser.java

@@ -16,6 +16,7 @@
 
 package org.springframework.web.util;
 
+import java.util.Locale;
 import java.util.Set;
 
 import org.apache.commons.logging.Log;
@@ -508,7 +509,8 @@ public InternalParser resolveIfOpaque() {
 		}
 
 		public InternalParser captureScheme() {
-			this.scheme = captureComponent("scheme").toLowerCase();
+			String scheme = captureComponent("scheme");
+			this.scheme = (!scheme.startsWith("{") ? scheme.toLowerCase(Locale.ROOT) : scheme);
 			return this;
 		}
 
@@ -633,8 +635,11 @@ public boolean processCurlyBrackets(char c) {
 				return true;
 			}
 			else if (c == '}') {
-				this.openCurlyBracketCount--;
-				return true;
+				if (this.openCurlyBracketCount > 0) {
+					this.openCurlyBracketCount--;
+					return true;
+				}
+				return false;
 			}
 			return (this.openCurlyBracketCount > 0);
 		}

Diff for: spring-web/src/main/java/org/springframework/web/util/WhatWgUrlParser.java

@@ -235,7 +235,7 @@ private void setState(State newState) {
 			logger.trace("Changing state from " + this.state + " to " + newState + " (cur: " + c + ")");
 		}
 		this.state = newState;
-		this.openCurlyBracketCount = 0;
+		this.openCurlyBracketCount = (this.buffer.toString().equals("{") ? this.openCurlyBracketCount : 0);
 	}
 
 	private boolean processCurlyBrackets(int c) {
@@ -244,8 +244,11 @@ private boolean processCurlyBrackets(int c) {
 			return true;
 		}
 		if (c == '}') {
-			this.openCurlyBracketCount--;
-			return true;
+			if (this.openCurlyBracketCount > 0) {
+				this.openCurlyBracketCount--;
+				return true;
+			}
+			return false;
 		}
 		return (this.openCurlyBracketCount > 0 && c != EOF);
 	}
@@ -756,7 +759,7 @@ private enum State {
 			public void handle(int c, UrlRecord url, WhatWgUrlParser p) {
 				// If c is an ASCII alpha, append c, lowercased, to buffer, and set state to scheme state.
 				if (isAsciiAlpha(c)) {
-					p.append(Character.toLowerCase((char) c));
+					p.append(p.openCurlyBracketCount == 0 ? Character.toLowerCase((char) c) : c);
 					p.setState(SCHEME);
 				}
 				// EXTRA: if c is '{', append to buffer and continue as SCHEME
@@ -782,7 +785,7 @@ else if (p.stateOverride == null) {
 			public void handle(int c, UrlRecord url, WhatWgUrlParser p) {
 				// If c is an ASCII alphanumeric, U+002B (+), U+002D (-), or U+002E (.), append c, lowercased, to buffer.
 				if (isAsciiAlphaNumeric(c) || (c == '+' || c == '-' || c == '.')) {
-					p.append(Character.toLowerCase((char) c));
+					p.append(p.openCurlyBracketCount == 0 ? Character.toLowerCase((char) c) : c);
 				}
 				// Otherwise, if c is U+003A (:), then:
 				else if (c == ':') {

Diff for: spring-web/src/test/java/org/springframework/web/util/UriComponentsBuilderTests.java

@@ -629,6 +629,16 @@ void buildAndExpandOpaque(ParserType parserType) {
 		assertThat(result.toUriString()).isEqualTo("mailto:[email protected]");
 	}
 
+	@ParameterizedTest // gh-33699
+	@EnumSource(value = ParserType.class)
+	void schemeVariableMixedCase(ParserType parserType) {
+		URI uri = UriComponentsBuilder
+				.fromUriString("{TheScheme}://example.org", parserType)
+				.buildAndExpand(Map.of("TheScheme", "ws"))
+				.toUri();
+		assertThat(uri.toString()).isEqualTo("ws://example.org");
+	}
+
 	@ParameterizedTest
 	@EnumSource(value = ParserType.class)
 	void queryParamWithValueWithEquals(ParserType parserType) {