check schemes urlutil can't parse

networkpolicy.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"net/url"
 	"regexp"
 	"strconv"
 
@@ -156,12 +157,20 @@ func (r NetworkPolicy) Validate(host string) bool {
 	var scheme string
 
 	// check if it's a valid URL
+	var u *url.URL
 	if URL, err := urlutil.Parse(host); err == nil {
+		u = URL.URL
+	} else if URL, err := url.Parse(host); err == nil {
+		// urlutil rejects schemes it doesn't know (gopher, dict, file...), which would otherwise skip the scheme and port lists
+		u = URL
+	}
+	if u != nil {
 		// parse scheme
-		scheme = URL.Scheme
+		scheme = u.Scheme
 		hasScheme = scheme != ""
 		// parse port
-		port, err = strconv.Atoi(URL.Port())
+		var err error
+		port, err = strconv.Atoi(u.Port())
 		if err == nil {
 			hasPort = true
 		}

networkpolicy_test.go

@@ -226,4 +226,18 @@ func TestValidateScheme(t *testing.T) {
 	require.True(t, allow.Validate("https://example.com"))
 	require.False(t, allow.Validate("ws://example.com"))
 	require.True(t, allow.Validate("example.com"))
+	require.True(t, allow.Validate("example.com:443"))
+
+	// schemes urlutil.Parse rejects
+	for _, u := range []string{"gopher://example.com:70/_x", "dict://example.com:11211/", "file:///etc/passwd", "GOPHER://example.com"} {
+		require.False(t, allow.Validate(u), u)
+	}
+
+	denyGopher, err := New(Options{DenySchemeList: []string{"gopher"}})
+	require.NoError(t, err)
+	require.False(t, denyGopher.Validate("gopher://example.com:70/_x"))
+
+	ports, err := New(Options{DenyPortList: []int{6379}})
+	require.NoError(t, err)
+	require.False(t, ports.Validate("gopher://example.com:6379/_x"))
 }