Refuse an image URL whose host is not a host name or IP address (closes #275) #285

Merged

clawbot merged 4 commits from issue-275-host-segment-characters into next 2026-10-16 01:14:51 +02:00

Conversation 3 Commits 4 Files Changed 4

+115 -5

4 Commits

Author	SHA1	Message	Date
sneak	42afa539de	Refuse brackets around anything but an IPv6 address in an image URL host ... The host check accepted any hex digits, : and . in brackets, so a host such as [203.0.113.5] or [abc] got through it, and Go's URL parser then refused the source URL, which the route answered with 401. The text in brackets must now parse as an IPv6 address, as Go's URL parser asks, or the host is refused with 400. The comment above the check now says only what is true of it. Model: opus-5-5	2026-10-15 22:55:37 +00:00
sneak	46ee9fa1ca	Test that the image route refuses brackets around no IPv6 address ... An IPv4 address in brackets, such as [203.0.113.5], and brackets around no address at all, such as [abc], must be refused with 400. They now pass the host check, and Go's URL parser refuses them later, so the route answers 401. The new rows fail until the fix lands. Model: opus-5-5	2026-10-15 22:53:42 +00:00
sneak	c6ee690e83	Refuse an image URL host that no URL host can be ... Only @ was refused in the host of a /v1/image/ URL, so a ? written as %3F gave the host cdn.example.com?x=1, which Go's URL parser reads as cdn.example.com with a query: it passed the allowlist and each text after the ? was cached under keys of its own. The host must now be a host name or an IPv4 address (letters, digits, -, _ and .) or an IPv6 address in brackets, either one optionally followed by : and a port; anything else is refused with 400. An IPv6 address without brackets, which needed a signature, is refused too. Model: opus-5-5	2026-10-15 22:30:24 +00:00
sneak	bb25e306a3	Test that the image route refuses a host no URL host can be ... A host written with a percent-encoded ?, #, %, \ or space, and an IPv6 address without brackets, must be refused with 400; a host name, an IPv4 address, an IPv6 address in brackets and a host with a port, or a : and no port, must still be served. The first test fails until the fix for #275 lands. Model: opus-5-5	2026-10-15 22:25:02 +00:00