config/security: Restrict default http.urls "@" deny to userinfo

bep · claude · bep · commit 454450a64711 · 2026-04-29T13:50:37.000+02:00
The previous "! @" deny rule rejected any URL containing "@", including legitimate version-pinned imports such as https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.esm.min.mjs. Tighten it to "! (?i)^https?://[^/?#]*@" so only "@" inside the authority section (i.e. real userinfo) is blocked. Fixes #14825 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
diff --git a/config/security/securityConfig.go b/config/security/securityConfig.go
@@ -59,7 +59,7 @@ var DefaultConfig = Config{
 		URLs: MustNewWhitelist(
 			`(?i)^https?://[a-z]`,
 			`! (?i)localhost`,
-			`! @`,
+			`! (?i)^https?://[^/?#]*@`,
 		),
 		Methods: MustNewWhitelist("(?i)GET|POST"),
 	},
diff --git a/config/security/securityConfig_test.go b/config/security/securityConfig_test.go
@@ -135,7 +135,7 @@ func TestToTOML(t *testing.T) {
 	got := DefaultConfig.ToTOML()
 
 	c.Assert(got, qt.Equals,
-		"[security]\n  enableInlineShortcodes = false\n\n  [security.exec]\n    allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']\n    osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$']\n\n  [security.funcs]\n    getenv = ['^HUGO_', '^CI$']\n\n  [security.http]\n    methods = ['(?i)GET|POST']\n    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']\n\n  [security.node]\n    [security.node.permissions]\n      allowAddons = ['tailwindcss']\n      allowRead = ['.']\n      allowWorker = ['tailwindcss']\n      allowWrite = []\n      disable = false",
+		"[security]\n  enableInlineShortcodes = false\n\n  [security.exec]\n    allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']\n    osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$']\n\n  [security.funcs]\n    getenv = ['^HUGO_', '^CI$']\n\n  [security.http]\n    methods = ['(?i)GET|POST']\n    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! (?i)^https?://[^/?#]*@']\n\n  [security.node]\n    [security.node.permissions]\n      allowAddons = ['tailwindcss']\n      allowRead = ['.']\n      allowWorker = ['tailwindcss']\n      allowWrite = []\n      disable = false",
 	)
 }
 
@@ -247,6 +247,32 @@ urls = ['.*', '! ^https?://evil\.example\.com']
 	})
 }
 
+func TestCheckAllowedHTTPURLAtInPathIssue14825(t *testing.T) {
+	t.Parallel()
+	c := qt.New(t)
+
+	pc, err := DecodeConfig(config.New())
+	c.Assert(err, qt.IsNil)
+
+	for _, u := range []string{
+		"https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.esm.min.mjs",
+		"https://unpkg.com/react@18/umd/react.production.min.js",
+		"https://example.org/foo@bar/baz",
+	} {
+		c.Assert(pc.CheckAllowedHTTPURL(u), qt.IsNil, qt.Commentf(u))
+	}
+
+	for _, u := range []string{
+		"http://user@127.0.0.1/",
+		"http://user:pass@example.org/",
+		"https://token@example.org/foo@bar",
+	} {
+		err := pc.CheckAllowedHTTPURL(u)
+		c.Assert(err, qt.IsNotNil, qt.Commentf(u))
+		c.Assert(err, qt.ErrorMatches, `(?s).*is not whitelisted in policy "security\.http\.urls".*`, qt.Commentf(u))
+	}
+}
+
 func TestDecodeConfigNodePermissions(t *testing.T) {
 	c := qt.New(t)
 
