policy: normalize HTTP schemes, host casing, and default ports - #4068
policy: normalize HTTP schemes, host casing, and default ports#4068crazy-max wants to merge 4 commits into
Conversation
c672b54 to
a84a5a3
Compare
thaJeztah
left a comment
thaJeztah
left a comment
There was a problem hiding this comment.
I'd probably squash the commits; if you amend the original commit, it still keeps the author (if we think it's worth preserving), so that's fine.
I left some suggestions for things we're currently missing.
| g := &Git{ | ||
| Schema: u.Scheme, | ||
| Remote: u.Remote, | ||
| Host: u.Host, |
There was a problem hiding this comment.
We probably need to normalize Git URLs as well? i.e.; https://github.com:443/docker/buildx.git or https://github.com:000443/docker/buildx.git would also need normalising.
There was a problem hiding this comment.
Yes agreed that Git over HTTP(S) should use the same normalization. I'd prefer to handle that in a follow-up, covering both remote URL paths and ensuring SSH/SCP remotes retain their existing behavior.
curl and similar tools include :443/:80 on the request URL. Policy then sees input.http.host as example.com:443, so an allow-list of example.com misses it. Drop those well-known ports; leave any other port in place. Signed-off-by: Dean Chen <862469039@qq.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
a84a5a3 to
f4567ef
Compare
crazy-max
changed the title
| {"https", "[2001:db8::1]", "[2001:db8::1]"}, | ||
| {"https", "[2001:DB8::ABCD]:443", "[2001:db8::abcd]"}, | ||
| {"https", "[FE80::ABCD%Eth0]:000443", "[fe80::abcd%Eth0]"}, | ||
| {"https", "[FE80::ABCD%Eth0]:8443", "[fe80::abcd%Eth0]:8443"}, |
There was a problem hiding this comment.
See my other comment; this is an invalid address, and would be rejected.
There was a problem hiding this comment.
This test constructs url.URL{Host: ...} directly, so the decoded %Eth0 is intentional. The https-ipv6-zone-case-preserved source-conversion test separately parses a URL containing %25Eth0 and verifies the decoded host.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
3 participants
fixes #4061
closes #4065
Normalize HTTP policy input so hostname allowlists match requests regardless of scheme casing, host casing, or explicit default ports, including curl requests through the exec proxy. Strip
:80for HTTP and:443for HTTPS, including zero-padded forms, while preserving non-default ports, IPv6 brackets and zone casing, and the original URL. Existing policies matching explicit default ports or mixed-case hostnames must use the normalized host instead.This supersedes #4065, retaining its original commit and adding simplified normalization, case handling, and regression coverage through source conversion and policy evaluation.