From 1b11a1dfeaa47e9eb9da8724fb29f1e53bdb6ef7 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Thu, 11 Jun 2026 04:28:01 -0700 Subject: [PATCH] fix: reject malformed provider hosts --- .../ProviderEndpointOverrideValidator.swift | 2 ++ .../AlibabaCodingPlanProviderTests.swift | 12 ++++++++++++ Tests/CodexBarTests/MiniMaxProviderTests.swift | 12 ++++++++++++ 3 files changed, 26 insertions(+) diff --git a/Sources/CodexBarCore/ProviderEndpointOverrideValidator.swift b/Sources/CodexBarCore/ProviderEndpointOverrideValidator.swift index ec1d39a8d7..0691c363d9 100644 --- a/Sources/CodexBarCore/ProviderEndpointOverrideValidator.swift +++ b/Sources/CodexBarCore/ProviderEndpointOverrideValidator.swift @@ -99,6 +99,8 @@ struct ProviderEndpointOverrideValidator: Sendable { guard let decodedHost = url.host(percentEncoded: false)?.lowercased(), !decodedHost.isEmpty, !decodedHost.contains("%"), + decodedHost.rangeOfCharacter(from: .whitespacesAndNewlines) == nil, + decodedHost.rangeOfCharacter(from: .controlCharacters) == nil, let encodedHost = url.host(percentEncoded: true)?.lowercased(), self.hostHasNoEncodedDelimiters(encodedHost, decodedHost: decodedHost, url: url) else { return nil } diff --git a/Tests/CodexBarTests/AlibabaCodingPlanProviderTests.swift b/Tests/CodexBarTests/AlibabaCodingPlanProviderTests.swift index e6f5563eaa..5e7534e31f 100644 --- a/Tests/CodexBarTests/AlibabaCodingPlanProviderTests.swift +++ b/Tests/CodexBarTests/AlibabaCodingPlanProviderTests.swift @@ -88,6 +88,18 @@ struct AlibabaCodingPlanSettingsReaderTests { ]) == nil) } + @Test + func `endpoint overrides reject whitespace and control characters in hosts`() { + for host in ["https://bad host", "https://bad%20host", "https://bad%09host"] { + #expect(AlibabaCodingPlanSettingsReader.hostOverride(environment: [ + AlibabaCodingPlanSettingsReader.hostKey: host, + ]) == nil) + #expect(AlibabaCodingPlanSettingsReader.quotaURL(environment: [ + AlibabaCodingPlanSettingsReader.quotaURLKey: "\(host)/data/api.json", + ]) == nil) + } + } + @Test func `endpoint overrides require https and no userinfo`() { #expect(AlibabaCodingPlanSettingsReader.hostOverride(environment: [ diff --git a/Tests/CodexBarTests/MiniMaxProviderTests.swift b/Tests/CodexBarTests/MiniMaxProviderTests.swift index ebee142d0b..03dd11c874 100644 --- a/Tests/CodexBarTests/MiniMaxProviderTests.swift +++ b/Tests/CodexBarTests/MiniMaxProviderTests.swift @@ -62,6 +62,18 @@ struct MiniMaxEndpointOverrideSettingsTests { ]) == nil) } + @Test + func `endpoint overrides reject whitespace and control characters in hosts`() { + for host in ["https://bad host", "https://bad%20host", "https://bad%09host"] { + #expect(MiniMaxSettingsReader.hostOverride(environment: [ + MiniMaxSettingsReader.hostKey: host, + ]) == nil) + #expect(MiniMaxSettingsReader.remainsURL(environment: [ + MiniMaxSettingsReader.remainsURLKey: "\(host)/remains", + ]) == nil) + } + } + @Test func `endpoint overrides require https and no userinfo`() { #expect(MiniMaxSettingsReader.hostOverride(environment: [