kubernetes-sigs/kustomize
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kustomize.git synced 2026-05-17 10:15:22 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

fix: url.ParseRequestURI before http.Get

Browse Source 
Signed-off-by: seipan <yamasakipann0218@gmail.com>
This commit is contained in:
seipan
2025-08-21 17:17:56 +09:00
parent 11f9435b50
commit 2a79ea148d
2 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/internal/loader/fileloader.go
View File

@@ -311,7 +311,11 @@ func (fl *FileLoader) httpClientGetContent(path string) ([]byte, error) {
} else {
hc = &http.Client{}
}
resp, err := hc.Get(path)
parsedURL, err := url.ParseRequestURI(path)
if err != nil {
return nil, errors.Wrap(err)
}
resp, err := hc.Get(parsedURL.String())
if err != nil {
return nil, errors.Wrap(err)
}

12
api/internal/loader/fileloader_test.go
View File

@@ -676,3 +676,15 @@ func setupOnDisk(t *testing.T) (filesys.FileSystem, filesys.ConfirmedDir) {
})
return fSys, dir
}
// TestLoaderHTTPMalformedURL tests that malformed URLs are properly handled
// to prevent infinite loops in http.Client.Get
func TestLoaderHTTPMalformedURL(t *testing.T) {
require := require.New(t)
malformedURL := "https://example.com/example?ref=main - ../../example/example.yaml"
l1 := NewLoaderOrDie(
RestrictionRootOnly, MakeFakeFs([]testData{}), filesys.Separator)
_, err := l1.Load(malformedURL)
require.Error(err)
require.Equal("HTTP Error: status code 500 (Internal Server Error)", err.Error())
}