Repository navigation
Warn on url values new URL() accepts but are not real URLs; default to http/https - #1220
Conversation
github-actions
Bot
added
maintainer
core:website
core:varlock
core:vscode-plugin
labels
|
The changes in this PR will be included in the next version bump.
|
📦 Bundle size
dist/ only; native binaries are versioned separately and not counted here. |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Two integration gaps need addressing: URL warnings bypass sensitive-value safety checks, and nested URL warnings become blocking errors immediately.
Reviewed changes Reviewed the runtime URL checks, editor diagnostics, tests, and migration documentation.
- URL structure warnings: Flag opaque URLs, missing hosts, whitespace, and malformed special-scheme hosts without intentionally rejecting existing values.
- Protocol options: Warn on implicit non-HTTP protocols, support wildcard allowlists, and add
allowNoHost. - Editor and docs: Mirror advisory checks in VS Code, add completion, and document the next-major transition with corrected examples.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes Reviewed the advisory-validation fixes added since the previous review.
- Continued safety checks: Retained warning-only type results while running subsequent sensitive-value validation.
- Preserved nested severity: Kept warning severity and migration tips through array and record validation wrappers.
- Added regression coverage: Covered nested structural and protocol warnings, genuine nested failures, and minimum sensitive-value length enforcement.
Verified the runtime build, 317 data-type tests, 32 editor diagnostic tests, and additional probes for warning retention and deeper nesting.
gpt-6.1-sol ｜ 𝕏
@type=urlvalidates withnew URL(), which accepts anyword:reststring as a URL with an opaque path. A user hit this with an SSH key fingerprint (SHA256:nThbg6...parses as schemesha256:), and the same goes foruser:pass,localhost:3000, andC:\path. Forhttp/httpsthe parser also silently repairs malformed input (https:///example.com,http://0x7f.1,https://a..b), and it strips whitespace the raw value still carries.This PR adds those checks as warnings, to become errors in the next major (one constant,
STRICT_URL_SEVERITY, markedTODO(next major)). A value is flagged if it:scheme://allowNoHost=trueforsqlite:///app.db,file:///...,postgresql:///db?host=...)http/https/ws/wss/ftp: uses a backslash, a percent-encoded host, IPv4 shorthand, or a hostname with empty or hyphen-edged labelsIt also warns when the protocol is not
http/httpsandallowedProtocolsis not set, since the next major makeshttp/httpsthe default. The tip names the fix (allowedProtocols=[postgres]), and the newallowedProtocols="*"allows any protocol.The VSCode extension shows the same checks as warnings, and completes
allowNoHost. Docs describe the checks with a caution about the next major; theDATABASE_URLexamples in the guides now setallowedProtocols, and the README example (API_URL=localhost:${API_PORT}, which only passed because of this) useshttp://.Two supporting fixes so these warnings stay advisory: a type's validation result that contains only warnings no longer stops the checks after it (the sensitive-value length checks still run), and nested validation errors in
array/recordkeep their severity instead of being rewrapped as errors.