From 3d28807eb7ccc24be84c3e0d3c47a95553b9cb34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Do=C4=9Fan=20Can=20Bak=C4=B1r?= Date: Tue, 27 Oct 2026 15:15:59 +0300 Subject: [PATCH] check schemes urlutil can't parse --- networkpolicy.go | 13 +++++++++++-- networkpolicy_test.go | 14 ++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/networkpolicy.go b/networkpolicy.go index dba28b4..822bd3f 100644 --- a/networkpolicy.go +++ b/networkpolicy.go @@ -4,6 +4,7 @@ import ( "fmt" "net" "net/netip" + "net/url" "regexp" "strconv" @@ -156,12 +157,20 @@ func (r NetworkPolicy) Validate(host string) bool { var scheme string // check if it's a valid URL + var u *url.URL if URL, err := urlutil.Parse(host); err == nil { + u = URL.URL + } else if URL, err := url.Parse(host); err == nil { + // urlutil rejects schemes it doesn't know (gopher, dict, file...), which would otherwise skip the scheme and port lists + u = URL + } + if u != nil { // parse scheme - scheme = URL.Scheme + scheme = u.Scheme hasScheme = scheme != "" // parse port - port, err = strconv.Atoi(URL.Port()) + var err error + port, err = strconv.Atoi(u.Port()) if err == nil { hasPort = true } diff --git a/networkpolicy_test.go b/networkpolicy_test.go index f260b26..a7f2e37 100644 --- a/networkpolicy_test.go +++ b/networkpolicy_test.go @@ -226,4 +226,18 @@ func TestValidateScheme(t *testing.T) { require.True(t, allow.Validate("https://example.com")) require.False(t, allow.Validate("ws://example.com")) require.True(t, allow.Validate("example.com")) + require.True(t, allow.Validate("example.com:443")) + + // schemes urlutil.Parse rejects + for _, u := range []string{"gopher://example.com:70/_x", "dict://example.com:11211/", "file:///etc/passwd", "GOPHER://example.com"} { + require.False(t, allow.Validate(u), u) + } + + denyGopher, err := New(Options{DenySchemeList: []string{"gopher"}}) + require.NoError(t, err) + require.False(t, denyGopher.Validate("gopher://example.com:70/_x")) + + ports, err := New(Options{DenyPortList: []int{6379}}) + require.NoError(t, err) + require.False(t, ports.Validate("gopher://example.com:6379/_x")) }