compare the file scheme case-insensitively in isValid

src/main/java/org/apache/commons/validator/routines/UrlValidator.java

@@ -384,12 +384,15 @@ public boolean isValid(final String value) {
             return false;
         }
         final String authority = uri.getRawAuthority();
+        // URI schemes are case-insensitive (RFC 3986 3.1) and isValidScheme already matches case-blind,
+        // so the file: handling has to recognise the scheme case-blind too
+        final boolean fileScheme = "file".equalsIgnoreCase(scheme);
         // Special case - file: allows an empty authority, so only the authority check is skipped for it;
         // the path, query and fragment below are validated as they are for any other scheme
-        final boolean emptyFileAuthority = "file".equals(scheme) && GenericValidator.isBlankOrNull(authority);
+        final boolean emptyFileAuthority = fileScheme && GenericValidator.isBlankOrNull(authority);
         // Validate the authority
         if (!emptyFileAuthority
-                && ("file".equals(scheme) && authority != null && authority.contains(":") || !isValidAuthority(authority))) {
+                && (fileScheme && authority != null && authority.contains(":") || !isValidAuthority(authority))) {
             return false;
         }
         if (!isValidPath(uri.getRawPath()) || !isValidQuery(uri.getRawQuery()) || !isValidFragment(uri.getRawFragment())) {

src/test/java/org/apache/commons/validator/routines/UrlValidatorTest.java

@@ -173,6 +173,22 @@ void testFileSchemePath() {
         assertTrue(urlValidator.isValid("file:/C:/path/to/dir/"));
     }
 
+    @Test
+    void testFileSchemeCaseInsensitive() {
+        final String[] schemes = { "file" };
+        final UrlValidator urlValidator = new UrlValidator(schemes, UrlValidator.ALLOW_LOCAL_URLS);
+
+        // the scheme is case-insensitive, so an upper or mixed case file: URL is treated like the lower case form
+        assertTrue(urlValidator.isValid("file:///etc/hosts"));
+        assertTrue(urlValidator.isValid("FILE:///etc/hosts"));
+        assertTrue(urlValidator.isValid("File:///etc/hosts"));
+
+        // a Windows drive letter in the authority is never valid, whatever the scheme case, and must not
+        // slip past the guard the lower case form is checked against
+        assertFalse(urlValidator.isValid("file://C:/some.file"));
+        assertFalse(urlValidator.isValid("FILE://C:/some.file"));
+    }
+
     @Test
     void testFileSchemePathOptions() {
         final String[] schemes = { "file" };