From 298ad3e69d7c348c962a6650e48d566fed41a4ef Mon Sep 17 00:00:00 2001 From: riccardom Date: Mon, 14 Sep 2026 09:18:28 +0200 Subject: [PATCH] [client] Validate the resolved remote-job upload destination, not just the requested one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit validateBundleUploadURL ran on the job's URL or the MDM override and then ResolveUploadURL folded in the destination published by management, which never met the same check. A malformed or plaintext published value therefore slipped through resolution and failed later inside UploadDebugBundle's requireHTTPS, surfacing as a transport error instead of a validation one. Management validates at write time, so this only bites against an older or mismatched server — but the two destinations are interchangeable and should be held to one rule. Reported by cubic on #7514. --- client/internal/engine.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/client/internal/engine.go b/client/internal/engine.go index 21c6a4fe8..c33442b8d 100644 --- a/client/internal/engine.go +++ b/client/internal/engine.go @@ -1488,12 +1488,17 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR log.Infof("using MDM debug bundle upload URL override instead of the management-supplied value") uploadURL = override } + uploadURL = debug.ResolveUploadURL(uploadURL, e.DebugUploadURL()) + + // Validated after resolution, so the destination this deployment published + // meets the same rule as one named in the job. Management validates it at + // write time, but a peer can be talking to an older or mismatched server, + // and a bad value should surface here rather than as a transport error + // halfway through the upload. if err := validateBundleUploadURL(uploadURL); err != nil { return nil, err } - uploadURL = debug.ResolveUploadURL(uploadURL, e.DebugUploadURL()) - bundleDeps := debug.GeneratorDependencies{ InternalConfig: e.config.ProfileConfig, StatusRecorder: e.statusRecorder,