From 83fa22871e2bcd0ba45a008a53c0710e70dd93c1 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 7 Aug 2026 17:03:50 +0000 Subject: [PATCH] fix: reject allowlist_hosts entries containing no hostname labels Entries consisting only of dots (".", "..") are now a startup error naming the key and entry. Previously a bare "." passed validation and became a suffix pattern matching every trailing-dot FQDN upstream, bypassing URL signing. --- internal/config/config.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/internal/config/config.go b/internal/config/config.go index 95864fa..cb5b9b9 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -312,7 +312,11 @@ func (c *Config) validate() error { // validateAllowlistHost checks that an allowlist_hosts entry is a bare // hostname, optionally with a leading dot for suffix matching. URLs, -// paths, and whitespace indicate a misconfigured entry. +// paths, and whitespace indicate a misconfigured entry. An entry with +// no hostname labels (such as ".") is rejected: the allowlist matcher +// treats a leading dot as a suffix pattern, so a bare "." would match +// any upstream host written in FQDN trailing-dot form and effectively +// disable URL signing. func validateAllowlistHost(host string) error { if strings.Contains(host, "://") || strings.ContainsAny(host, "/ \t") { return fmt.Errorf( @@ -320,6 +324,12 @@ func validateAllowlistHost(host string) error { "allowlist_hosts", host) } + if strings.Trim(host, ".") == "" { + return fmt.Errorf( + "config key %q: entry %q contains no hostname labels", + "allowlist_hosts", host) + } + return nil }