sneak/pixa
1
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: reject allowlist_hosts entries containing no hostname labels

Browse Source 
Entries consisting only of dots (".", "..") are now a startup error
naming the key and entry. Previously a bare "." passed validation and
became a suffix pattern matching every trailing-dot FQDN upstream,
bypassing URL signing.
This commit is contained in:
Jeffrey Paul
2026-08-07 17:03:50 +00:00
parent 808356f142
commit 83fa22871e
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/config/config.go
View File

@@ -312,7 +312,11 @@ func (c *Config) validate() error {
// validateAllowlistHost checks that an allowlist_hosts entry is a bare // validateAllowlistHost checks that an allowlist_hosts entry is a bare
// hostname, optionally with a leading dot for suffix matching. URLs, // hostname, optionally with a leading dot for suffix matching. URLs,
// paths, and whitespace indicate a misconfigured entry. // paths, and whitespace indicate a misconfigured entry. An entry with
// no hostname labels (such as ".") is rejected: the allowlist matcher
// treats a leading dot as a suffix pattern, so a bare "." would match
// any upstream host written in FQDN trailing-dot form and effectively
// disable URL signing.
func validateAllowlistHost(host string) error { func validateAllowlistHost(host string) error {
if strings.Contains(host, "://") || strings.ContainsAny(host, "/ \t") { if strings.Contains(host, "://") || strings.ContainsAny(host, "/ \t") {
return fmt.Errorf( return fmt.Errorf(
@@ -320,6 +324,12 @@ func validateAllowlistHost(host string) error {
"allowlist_hosts", host) "allowlist_hosts", host)
} }
if strings.Trim(host, ".") == "" {
return fmt.Errorf(
"config key %q: entry %q contains no hostname labels",
"allowlist_hosts", host)
}
return nil return nil
} }