From abd565c96a30631cdf675b512cd83fb0738130d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Tue, 14 Apr 2026 15:58:44 +0400 Subject: [PATCH] Reject origins with trailing empty port in validator MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Émile Ré --- pkg/validator/validator_format.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/validator/validator_format.go b/pkg/validator/validator_format.go index af3d51aa1..dc3d6c8b2 100644 --- a/pkg/validator/validator_format.go +++ b/pkg/validator/validator_format.go @@ -18,6 +18,7 @@ import ( "net/url" "regexp" "slices" + "strings" "go.probo.inc/probo/pkg/gid" ) @@ -160,7 +161,7 @@ func Origin() ValidatorFunc { return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") } - if parsedURL.Host == "" || parsedURL.Hostname() == "" { + if parsedURL.Host == "" || parsedURL.Hostname() == "" || strings.HasSuffix(parsedURL.Host, ":") { return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") }