mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
f865efb337
The parse-only catch-all proved the whole `http://{host}` string is a valid URL but not that {host} is exactly an authority. Query and fragment delimiters are legal URL characters and were not in the forbidden set, so `admin.example.com?x=1` and `[::1]#frag` passed startup: the suffix parsed as query/fragment, then canonical_url appended the admin path after it (`http://admin.example.com/?x=1/api/admin/v1/reports`), corrupting both the NIP-11 advertisement and the NIP-98 u-tag URL — the same accepted-config/ unusable-URL class as the bare-IPv6 defect. Validate the parsed sentinel structurally, mirroring parse_operator_api_origin: host present, no credentials, path `/`, no query, no fragment. Any non-authority character now lands in one of those and is rejected. Host still stored verbatim. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>