sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-05 04:59:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

[management] Reject a port-only authority in the debug upload URL

Browse Source 
DebugUpload.Validate checked url.Host, which is non-empty for an authority like
":443" even though there is no host. Management would store and publish it, and
every peer would then refuse it: the client-side rule the same value meets on
the CLI path already uses Hostname() for exactly this reason
(profilemanager.ValidateBundleUploadURL).

Reported by cubic on #7514.
This commit is contained in:
riccardom
2026-09-14 09:17:16 +02:00
parent 82aa7f7b04
commit a2cff0adf9
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/internals/server/config/debug_upload_test.go
+2
View File
@@ -21,6 +21,8 @@ func TestDebugUploadValidate(t *testing.T) {
{name: "http refused", url: "http://upload.example.com/upload-url", wantErr: "must use https"},
{name: "scheme-less refused", url: "upload.example.com/upload-url", wantErr: "must use https"},
{name: "host-less refused", url: "https:///upload-url", wantErr: "must have a host"},
// ":443" is a non-empty authority with no host; the peers refuse it.
{name: "port-only authority refused", url: "https://:443/upload-url", wantErr: "must have a host"},
{name: "unparsable refused", url: "https://upload.example.com:port", wantErr: "parse debug upload URL"},
}