♻️ fix types and validate destination Host correcly

server/lib/traefik/types.ts

@@ -36,7 +36,8 @@ export type ResourceWithTargets = Pick<
     | "tlsServerName"
     | "setHostHeader"
     | "enableProxy"
-    | "headers"
+    | "requestHeaders"
+    | "responseHeaders"
     | "proxyProtocol"
     | "wildcard"
     | "mode"
@@ -46,7 +47,10 @@ export type ResourceWithTargets = Pick<
     | "maintenanceMessage"
     | "maintenanceEstimatedTime"
 > &
-    Pick<Target, "path" | "pathMatchType" | "rewritePath" | "rewritePathType"> & {
+    Pick<
+        Target,
+        "path" | "pathMatchType" | "rewritePath" | "rewritePathType"
+    > & {
         /** Sanitized resource name used in router/service names */
         name: string;
         /** Sanitized resourceId + path config, unique per router */

server/routers/badger/verifySession.ts

@@ -41,7 +41,7 @@ import {
 } from "@server/db";
 import config from "@server/lib/config";
 import { isIpInCidr, stripPortFromHost } from "@server/lib/ip";
-import { isPathAllowed, type isPathAllowed } from "@server/lib/pathMatch";
+import { isPathAllowed } from "@server/lib/pathMatch";
 import { matchesPath } from "@server/lib/traefik/rule";
 import { rewriteRequestPath } from "@server/lib/traefik/middleware";
 import { parseHttpMethodList } from "@server/lib/validators";

server/routers/redirect/validation.ts

@@ -39,9 +39,7 @@ export function isValidMatchPath(
     matchPath: string | null | undefined,
     pathMatchType: string | null | undefined
 ): boolean {
-    return (
-        pathMatchType !== "regex" || !matchPath || isValidRegex(matchPath)
-    );
+    return pathMatchType !== "regex" || !matchPath || isValidRegex(matchPath);
 }
 
 export const redirectRewritePathSchema = z.string().nonempty();
@@ -54,15 +52,20 @@ export const redirectPrioritySchema = z.int().min(1).max(1000);
  * the request path (after any rewrite) is appended to it by badger.
  */
 export function isValidDestinationHost(value: string): boolean {
-    const match = /^https?:\/\/([^/:?#]+)(:\d{1,5})?$/.exec(value);
-    return match !== null && isValidDomain(match[1]);
+    if (URL.canParse(value)) {
+        const url = new URL(value);
+        /** URL origin contains the destination with no path or query */
+        return value === url.origin;
+    }
+    return false;
 }
 
 export const redirectDestinationHostSchema = z
     .string()
     .nonempty()
     .refine(isValidDestinationHost, {
-        message: "Invalid destination, expected scheme://host such as https://example.com"
+        message:
+            "Invalid destination, expected scheme://host such as https://example.com"
     });
 
 /**