External/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

revert: keep push gateway delivery HTTPS only

Browse Source 
Co-authored-by: Tom Brow <tomb@block.xyz>
Signed-off-by: Tom Brow <tomb@block.xyz>
This commit is contained in:
npub12wpjffj7q5qjsky5jvk4ldwlxmse5xll3d8gytk4wqd0c5y7jvwspg37n6
2026-07-31 10:07:03 -07:00
co-authored by Tom Brow
parent f8a1b12180
commit b1b16b2843
1 changed files with 2 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/buzz-relay/src/config.rs
+2 -43
View File
@@ -355,35 +355,13 @@ fn parse_operator_api_origin(raw: &str) -> Result<String, ConfigError> {
const DEFAULT_PUSH_GATEWAY_DELIVERY_URL: &str = "https://push.buzz.xyz/v1/deliveries/apns";
fn is_debug_loopback_push_gateway_url(url: &url::Url) -> bool {
#[cfg(debug_assertions)]
{
if url.scheme() != "http" {
return false;
}
match url.host() {
Some(url::Host::Domain(host)) => host == "localhost",
Some(url::Host::Ipv4(address)) => address.is_loopback(),
Some(url::Host::Ipv6(address)) => address.is_loopback(),
None => false,
}
}
#[cfg(not(debug_assertions))]
{
let _ = url;
false
}
}
fn parse_push_gateway_delivery_url(raw: &str) -> Result<url::Url, ConfigError> {
let url = url::Url::parse(raw.trim()).map_err(|e| {
ConfigError::InvalidValue(format!(
"BUZZ_PUSH_GATEWAY_DELIVERY_URL is not a valid URL: {e}"
))
})?;
if (url.scheme() != "https" && !is_debug_loopback_push_gateway_url(&url))
if url.scheme() != "https"
|| url.host().is_none()
|| !url.username().is_empty()
|| url.password().is_some()
@@ -392,7 +370,7 @@ fn parse_push_gateway_delivery_url(raw: &str) -> Result<url::Url, ConfigError> {
|| url.fragment().is_some()
{
return Err(ConfigError::InvalidValue(
"BUZZ_PUSH_GATEWAY_DELIVERY_URL must be an exact HTTPS /v1/deliveries/apns URL without credentials, query, or fragment (Debug builds also allow exact loopback HTTP URLs)"
"BUZZ_PUSH_GATEWAY_DELIVERY_URL must be an exact HTTPS /v1/deliveries/apns URL without credentials, query, or fragment"
.to_string(),
));
}
@@ -1468,9 +1446,6 @@ mod tests {
assert!(parse_push_gateway_delivery_url("https://push.example/v1/deliveries/apns").is_ok());
for invalid in [
"http://push.example/v1/deliveries/apns",
"http://localhost.example/v1/deliveries/apns",
"http://localhost@push.example/v1/deliveries/apns",
"http://192.168.1.10/v1/deliveries/apns",
"https://push.example/v1/deliveries/apns/",
"https://push.example/v1/deliveries/apns?token=x",
"https://user@push.example/v1/deliveries/apns",
@@ -1482,22 +1457,6 @@ mod tests {
}
}
#[test]
fn push_gateway_http_loopback_is_debug_only() {
for url in [
"http://localhost:8080/v1/deliveries/apns",
"http://127.0.0.1:8080/v1/deliveries/apns",
"http://[::1]:8080/v1/deliveries/apns",
] {
let result = parse_push_gateway_delivery_url(url);
if cfg!(debug_assertions) {
assert!(result.is_ok(), "{url}: {result:?}");
} else {
assert!(result.is_err(), "{url}");
}
}
}
#[test]
fn invalid_push_gateway_timeout_is_not_silently_defaulted() {
let _guard = ENV_MUTEX.lock().unwrap();