fix: Treat a scheme-less endpoint host as invalid - #1014
Merged
Conversation
getUrlPrefix accepted any string the URL constructor could parse, so an endpoint like localhost:3000 parsed with localhost: as the scheme and built a garbage request URL. Only http and https URLs are absolute endpoints now; anything else resolves against the browser origin or raises the existing cannot-resolve-origin error. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK audit finding L1d (low):
getUrlPrefixaccepted any string theURLconstructor could parse.localhost:3000parses withlocalhost:as the scheme (and3000as the path), so the requesturlgetter built garbage likelocalhost:3000/devices/get?x=1instead of failing.Fix
Only
http:/https:URLs are treated as absolute endpoints. Anything else takes the existing fallback path: resolved against the browser origin, or the existingCannot resolve originerror in a non-browser environment.Tests
endpoint: 'localhost:3000'→request.urlthrowsCannot resolve origin(fails on reverted source, which builds the garbage URL)endpoint: 'http://localhost:3000'→ builds the correct URLFull suite (127 tests), lint, typecheck green.
Part of applying the rev-3 SDK audit (one PR per finding). Related: #1002–#1013.
🤖 Generated with Claude Code
https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Generated by Claude Code