Fix PR review feedback

- Preserve SSRF protection by wrapping the existing transport
  instead of replacing it with a bare http.Transport
- Strip DSN from url.Parse error to avoid leaking credentials
- Gate CommonThirdPartyCombobox on search length to prevent
  showing stale results when input is shortened
- Handle multi-value and uppercase sizes attributes in
  parseSizeAttr for correct icon-size ranking
- Match rel tokens containing "icon" (e.g. "shortcut icon")
  instead of requiring an exact match
- Limit HTML response body to 10 MiB before parsing
- Reject sslmode=prefer explicitly in both import tools

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/webinspect/logo.go

@@ -45,7 +45,7 @@ func FindLogoURL(info *PageInfo) (string, error) {
 		}
 
 		switch {
-		case rel == "icon" && attrVal(n, "type") == "image/svg+xml":
+		case strings.Contains(rel, "icon") && !strings.Contains(rel, "apple-touch-icon") && attrVal(n, "type") == "image/svg+xml":
 			svgIcon = href
 		case strings.Contains(rel, "apple-touch-icon"):
 			size := parseSizeAttr(attrVal(n, "sizes"))
@@ -53,7 +53,7 @@ func FindLogoURL(info *PageInfo) (string, error) {
 				appleTouchIcon = href
 				appleTouchSize = size
 			}
-		case rel == "icon":
+		case strings.Contains(rel, "icon") && !strings.Contains(rel, "apple-touch-icon"):
 			size := parseSizeAttr(attrVal(n, "sizes"))
 			if largestIcon == "" || size > largestSize {
 				largestIcon = href
@@ -87,21 +87,29 @@ func FindLogoURL(info *PageInfo) (string, error) {
 }
 
 func parseSizeAttr(sizes string) int {
-	if sizes == "" || strings.ToLower(sizes) == "any" {
+	if sizes == "" || strings.EqualFold(sizes, "any") {
 		return 0
 	}
 
-	parts := strings.SplitN(sizes, "x", 2)
-	if len(parts) == 0 {
-		return 0
+	best := 0
+	for _, token := range strings.Fields(sizes) {
+		token = strings.ToLower(token)
+		parts := strings.SplitN(token, "x", 2)
+		if len(parts) != 2 {
+			continue
+		}
+
+		w, err := strconv.Atoi(parts[0])
+		if err != nil {
+			continue
+		}
+
+		if w > best {
+			best = w
+		}
 	}
 
-	w, err := strconv.Atoi(parts[0])
-	if err != nil {
-		return 0
-	}
-
-	return w
+	return best
 }
 
 func ExtensionForMIME(contentType string) string {

pkg/webinspect/parse.go

@@ -50,7 +50,8 @@ func Parse(ctx context.Context, client *http.Client, websiteURL string) (*PageIn
 		return nil, fmt.Errorf("cannot fetch page: status %d", resp.StatusCode)
 	}
 
-	return ParseHTML(parsed, resp.Body)
+	const maxHTMLSize = 10 << 20 // 10 MiB
+	return ParseHTML(parsed, io.LimitReader(resp.Body, maxHTMLSize))
 }
 
 func ParseHTML(baseURL *url.URL, r io.Reader) (*PageInfo, error) {