INNER CODE UNIT · Go

validateURL

orneryd/NornicDB · cmd/eval/main.go:471

func validateURL(rawURL string) error {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return fmt.Errorf("malformed URL: %w", err)
	}
	// Only allow http and https schemes
	if parsed.Scheme != "http" && parsed.Scheme != "https" {
		return fmt.Errorf("invalid scheme %q: only http and https are allowed", parsed.Scheme)
	}
	// Ensure host is present
	if parsed.Host == "" {
		return fmt.Errorf("missing host in URL")
	}
	// Reject URLs with userinfo (potential confusion attacks)
	if parsed.User != nil {
		return fmt.Errorf("URLs with userinfo are not allowed")
	}
	// Allow override via NORNICDB_ALLOW_REMOTE_EVAL=true for legitimate remote testing

View source record →