From 10ac52eff317df393d5bddcc23b476204792791b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Tue, 12 May 2026 10:12:02 +0400
Subject: [PATCH] Fix PR review feedback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Preserve SSRF protection by wrapping the existing transport
  instead of replacing it with a bare http.Transport
- Strip DSN from url.Parse error to avoid leaking credentials
- Gate CommonThirdPartyCombobox on search length to prevent
  showing stale results when input is shortened
- Handle multi-value and uppercase sizes attributes in
  parseSizeAttr for correct icon-size ranking
- Match rel tokens containing "icon" (e.g. "shortcut icon")
  instead of requiring an exact match
- Limit HTML response body to 10 MiB before parsing
- Reject sslmode=prefer explicitly in both import tools

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 .../vendors/dialogs/CreateVendorDialog.tsx    |  2 +-
 cmd/common-third-parties-import/main.go       |  8 +++--
 cmd/geoloc-import/main.go                     |  6 ++--
 pkg/webinspect/logo.go                        | 32 ++++++++++++-------
 pkg/webinspect/parse.go                       |  3 +-
 5 files changed, 32 insertions(+), 19 deletions(-)

diff --git a/apps/console/src/pages/organizations/vendors/dialogs/CreateVendorDialog.tsx b/apps/console/src/pages/organizations/vendors/dialogs/CreateVendorDialog.tsx
index 72195be54..01c5ba78d 100644
--- a/apps/console/src/pages/organizations/vendors/dialogs/CreateVendorDialog.tsx
+++ b/apps/console/src/pages/organizations/vendors/dialogs/CreateVendorDialog.tsx
@@ -98,7 +98,7 @@ export function CreateVendorDialog({
     <Dialog ref={dialogRef} trigger={children} title={__("Add a vendor")}>
       <DialogContent className="p-6">
         <Combobox onSearch={handleSearch} placeholder={__("Type vendor's name")}>
-          {queryRef && (
+          {searchQuery.trim().length >= 2 && queryRef && (
             <Suspense>
               <CommonThirdPartyCombobox
                 queryRef={queryRef}
diff --git a/cmd/common-third-parties-import/main.go b/cmd/common-third-parties-import/main.go
index d02774a9e..079a1a92a 100644
--- a/cmd/common-third-parties-import/main.go
+++ b/cmd/common-third-parties-import/main.go
@@ -454,7 +454,7 @@ func parseCategory(tp thirdPartyData) coredata.VendorCategory {
 func newPgClientFromDSN(dsn string) (*pg.Client, error) {
 	u, err := url.Parse(dsn)
 	if err != nil {
-		return nil, fmt.Errorf("cannot parse DSN: %w", err)
+		return nil, fmt.Errorf("cannot parse DSN (check URL format)")
 	}
 
 	var opts []pg.Option
@@ -462,10 +462,12 @@ func newPgClientFromDSN(dsn string) (*pg.Client, error) {
 	switch u.Query().Get("sslmode") {
 	case "", "disable":
 		// plain connection, no TLS
-	case "require", "prefer":
+	case "require":
 		opts = append(opts, pg.WithUnsecureTLS())
+	case "prefer":
+		return nil, fmt.Errorf("unsupported sslmode %q (prefer fallback semantics are not supported)", u.Query().Get("sslmode"))
 	default:
-		return nil, fmt.Errorf("unsupported sslmode %q (only disable, require, prefer are supported)", u.Query().Get("sslmode"))
+		return nil, fmt.Errorf("unsupported sslmode %q", u.Query().Get("sslmode"))
 	}
 
 	if u.Host != "" {
diff --git a/cmd/geoloc-import/main.go b/cmd/geoloc-import/main.go
index 933cc4c5c..a09fee07d 100644
--- a/cmd/geoloc-import/main.go
+++ b/cmd/geoloc-import/main.go
@@ -82,10 +82,12 @@ func newPgClientFromDSN(dsn string) (*pg.Client, error) {
 	switch u.Query().Get("sslmode") {
 	case "", "disable":
 		// plain connection, no TLS
-	case "require", "prefer":
+	case "require":
 		opts = append(opts, pg.WithUnsecureTLS())
+	case "prefer":
+		return nil, fmt.Errorf("unsupported sslmode %q (prefer fallback semantics are not supported)", u.Query().Get("sslmode"))
 	default:
-		return nil, fmt.Errorf("unsupported sslmode %q (only disable, require, prefer are supported)", u.Query().Get("sslmode"))
+		return nil, fmt.Errorf("unsupported sslmode %q", u.Query().Get("sslmode"))
 	}
 
 	if u.Host != "" {
diff --git a/pkg/webinspect/logo.go b/pkg/webinspect/logo.go
index 193432ba0..9f0dd20b9 100644
--- a/pkg/webinspect/logo.go
+++ b/pkg/webinspect/logo.go
@@ -45,7 +45,7 @@ func FindLogoURL(info *PageInfo) (string, error) {
 		}
 
 		switch {
-		case rel == "icon" && attrVal(n, "type") == "image/svg+xml":
+		case strings.Contains(rel, "icon") && !strings.Contains(rel, "apple-touch-icon") && attrVal(n, "type") == "image/svg+xml":
 			svgIcon = href
 		case strings.Contains(rel, "apple-touch-icon"):
 			size := parseSizeAttr(attrVal(n, "sizes"))
@@ -53,7 +53,7 @@ func FindLogoURL(info *PageInfo) (string, error) {
 				appleTouchIcon = href
 				appleTouchSize = size
 			}
-		case rel == "icon":
+		case strings.Contains(rel, "icon") && !strings.Contains(rel, "apple-touch-icon"):
 			size := parseSizeAttr(attrVal(n, "sizes"))
 			if largestIcon == "" || size > largestSize {
 				largestIcon = href
@@ -87,21 +87,29 @@ func FindLogoURL(info *PageInfo) (string, error) {
 }
 
 func parseSizeAttr(sizes string) int {
-	if sizes == "" || strings.ToLower(sizes) == "any" {
+	if sizes == "" || strings.EqualFold(sizes, "any") {
 		return 0
 	}
 
-	parts := strings.SplitN(sizes, "x", 2)
-	if len(parts) == 0 {
-		return 0
+	best := 0
+	for _, token := range strings.Fields(sizes) {
+		token = strings.ToLower(token)
+		parts := strings.SplitN(token, "x", 2)
+		if len(parts) != 2 {
+			continue
+		}
+
+		w, err := strconv.Atoi(parts[0])
+		if err != nil {
+			continue
+		}
+
+		if w > best {
+			best = w
+		}
 	}
 
-	w, err := strconv.Atoi(parts[0])
-	if err != nil {
-		return 0
-	}
-
-	return w
+	return best
 }
 
 func ExtensionForMIME(contentType string) string {
diff --git a/pkg/webinspect/parse.go b/pkg/webinspect/parse.go
index 6fb46dbe9..8f66fe2ca 100644
--- a/pkg/webinspect/parse.go
+++ b/pkg/webinspect/parse.go
@@ -50,7 +50,8 @@ func Parse(ctx context.Context, client *http.Client, websiteURL string) (*PageIn
 		return nil, fmt.Errorf("cannot fetch page: status %d", resp.StatusCode)
 	}
 
-	return ParseHTML(parsed, resp.Body)
+	const maxHTMLSize = 10 << 20 // 10 MiB
+	return ParseHTML(parsed, io.LimitReader(resp.Body, maxHTMLSize))
 }
 
 func ParseHTML(baseURL *url.URL, r io.Reader) (*PageInfo, error) {