Repository navigation
fix(lab-ops-hub): container validator refuses bare 0x hosts - #509
Conversation
The numeric-final-label pattern from #502 required at least one hex digit after a 0x prefix, so a bare 0x/0X final label fell through to 'public DNS name'. WHATWG's IPv4-number parser returns 0 for a bare prefix (0x alone normalises to 0.0.0.0), and the Worker validator refuses every spelling. Allow zero hex digits in the pattern; a trailing non-hex character (0xg, 0x7fg) still fails the full match and stays a DNS name on both sides. Fixes #504
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 2
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a316672f00
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # in a number — refuse them too (#504). A trailing non-hex | ||
| # character (0xg, 0x7fg) still fails the full match and | ||
| # stays a DNS name, as in WHATWG. | ||
| if re.fullmatch(r"0[xX][0-9a-fA-F]*|[0-9]+", last_label): |
There was a problem hiding this comment.
When a redirect uses an all-numeric host such as http://8.8.8.0x/, WHATWG parses the bare final component as zero and the Worker normalizes and accepts it as public 8.8.8.0. Python's socket.inet_aton does not recognize that spelling, so this new unconditional final-label match instead rejects it, causing the container crawl to return 502 and unnecessarily fall back to the Worker. Distinguish malformed names such as example.0x from valid numeric IPv4 components before rejecting the host.
Useful? React with 👍 / 👎.
Problem
Fixes #504. PR #503's numeric-final-label check in the lab-ops-hub container validator (pkgs/lab-ops-hub/container/app.py) used
0[xX][0-9a-fA-F]+, requiring at least one hex digit after the prefix. A bare0x/0Xfinal label therefore fell through to 'a public DNS name' and was ALLOWed, while the Worker validator refuses every spelling: WHATWG's IPv4-number parser returns 0 for a bare prefix, and the single-label0xnormalises to 0.0.0.0 (non-public).Reproduced on main d4809cf:
example.0x,example.0X,example.0x.,0x,0Xall ALLOW in Python vs BLOCK in TS.Solution
Allow zero hex digits:
0[xX][0-9a-fA-F]*. A trailing non-hex character (0xg,0x7fg) still fails the full match and stays a DNS name, matching WHATWG on both sides. Redirect targets inherit via the same function.Verification
test_refuses_bare_0x_final_labelcovers the five refused spellings plus the two non-hex controls as accepted.npm testin pkgs/lab-ops-hub: TS 18/18, Python 12/12 pass.Single-repo: lab-ops-hub exists only in developing-today/code.
Need help on this PR? Tag
@codesmith-botwith what you need.