sneak
23506df609
All checks were successful
check / check (push) Successful in 2m3s
Replace .golangci.yml with the canonical v2-schema config (default: all minus six disabled linters, lll 88, tests included) and bump every golangci-lint pin to v2.12.2: - Dockerfile: golangci/golangci-lint:v2.12.2-alpine (hash-pinned) - script/bootstrap: GOLANGCI_LINT_VERSION 2.12.2 with new linux-amd64/arm64 release-archive sha256 pins Fix all 747 findings the stricter config surfaces, with no behavior changes: t.Parallel() throughout the test suite, static sentinel errors and errors.Is comparisons, checked error returns, context propagation (contextcheck/noctx), 88-column wrapping, extracted constants and helpers for goconst/dupl/funlen/cyclop, exhaustive switch cases replicating existing defaults, and white-box test files renamed to *_internal_test.go for testpackage. Three nolint:tagliatelle directives preserve the existing snake_case JSON wire and on-disk metadata formats.
85 lines
2.0 KiB
Go
85 lines
2.0 KiB
Go
// Package allowlist provides host-based URL allow-listing for the image proxy.
|
|
package allowlist
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
// HostAllowList checks whether source hosts are permitted.
|
|
type HostAllowList struct {
|
|
// exactHosts contains hosts that must match exactly (e.g., "cdn.example.com")
|
|
exactHosts map[string]struct{}
|
|
// suffixHosts contains domain suffixes to match
|
|
// (e.g., ".example.com" matches "cdn.example.com")
|
|
suffixHosts []string
|
|
}
|
|
|
|
// New creates a HostAllowList from a list of host patterns.
|
|
// Patterns starting with "." are treated as suffix matches.
|
|
// Examples:
|
|
// - "cdn.example.com" - exact match only
|
|
// - ".example.com" - matches cdn.example.com, images.example.com, etc.
|
|
func New(patterns []string) *HostAllowList {
|
|
w := &HostAllowList{
|
|
exactHosts: make(map[string]struct{}),
|
|
suffixHosts: make([]string, 0),
|
|
}
|
|
|
|
for _, pattern := range patterns {
|
|
pattern = strings.ToLower(strings.TrimSpace(pattern))
|
|
if pattern == "" {
|
|
continue
|
|
}
|
|
|
|
if strings.HasPrefix(pattern, ".") {
|
|
w.suffixHosts = append(w.suffixHosts, pattern)
|
|
} else {
|
|
w.exactHosts[pattern] = struct{}{}
|
|
}
|
|
}
|
|
|
|
return w
|
|
}
|
|
|
|
// IsAllowed checks if a URL's host is in the allow list.
|
|
func (w *HostAllowList) IsAllowed(u *url.URL) bool {
|
|
if u == nil {
|
|
return false
|
|
}
|
|
|
|
host := strings.ToLower(u.Hostname())
|
|
if host == "" {
|
|
return false
|
|
}
|
|
|
|
// Check exact match
|
|
if _, ok := w.exactHosts[host]; ok {
|
|
return true
|
|
}
|
|
|
|
// Check suffix match
|
|
for _, suffix := range w.suffixHosts {
|
|
if strings.HasSuffix(host, suffix) {
|
|
return true
|
|
}
|
|
// Also match if host equals the suffix without the leading dot
|
|
// e.g., pattern ".example.com" should match "example.com"
|
|
if host == strings.TrimPrefix(suffix, ".") {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// IsEmpty returns true if the allow list has no entries.
|
|
func (w *HostAllowList) IsEmpty() bool {
|
|
return len(w.exactHosts) == 0 && len(w.suffixHosts) == 0
|
|
}
|
|
|
|
// Count returns the total number of allow list entries.
|
|
func (w *HostAllowList) Count() int {
|
|
return len(w.exactHosts) + len(w.suffixHosts)
|
|
}
|