From a2cff0adf9deee69a418cc35b17f121f9db4269b Mon Sep 17 00:00:00 2001 From: riccardom Date: Mon, 14 Sep 2026 09:17:16 +0200 Subject: [PATCH] [management] Reject a port-only authority in the debug upload URL DebugUpload.Validate checked url.Host, which is non-empty for an authority like ":443" even though there is no host. Management would store and publish it, and every peer would then refuse it: the client-side rule the same value meets on the CLI path already uses Hostname() for exactly this reason (profilemanager.ValidateBundleUploadURL). Reported by cubic on #7514. --- management/internals/server/config/config.go | 5 ++++- management/internals/server/config/debug_upload_test.go | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/management/internals/server/config/config.go b/management/internals/server/config/config.go index 50028660a..3cdbe41e4 100644 --- a/management/internals/server/config/config.go +++ b/management/internals/server/config/config.go @@ -247,7 +247,10 @@ func (d DebugUpload) Validate() error { if parsed.Scheme != "https" { return fmt.Errorf("debug upload URL must use https, got scheme %q", parsed.Scheme) } - if parsed.Host == "" { + // Hostname(), not Host: an authority like ":443" is non-empty but has no + // host, and the peers reject it (see profilemanager.ValidateBundleUploadURL). + // Management must not publish a destination its own clients refuse. + if parsed.Hostname() == "" { return errors.New("debug upload URL must have a host") } diff --git a/management/internals/server/config/debug_upload_test.go b/management/internals/server/config/debug_upload_test.go index dd52c9790..65c706b72 100644 --- a/management/internals/server/config/debug_upload_test.go +++ b/management/internals/server/config/debug_upload_test.go @@ -21,6 +21,8 @@ func TestDebugUploadValidate(t *testing.T) { {name: "http refused", url: "http://upload.example.com/upload-url", wantErr: "must use https"}, {name: "scheme-less refused", url: "upload.example.com/upload-url", wantErr: "must use https"}, {name: "host-less refused", url: "https:///upload-url", wantErr: "must have a host"}, + // ":443" is a non-empty authority with no host; the peers refuse it. + {name: "port-only authority refused", url: "https://:443/upload-url", wantErr: "must have a host"}, {name: "unparsable refused", url: "https://upload.example.com:port", wantErr: "parse debug upload URL"}, }