Skip to content

feat(operator)!: Add UrlExt::join_safe function - #1319

Merged
Techassi merged 17 commits into
mainfrom
feat/safe-url-join
Nov 2, 2026
Merged

Techassi merged 17 commits into
mainfrom
feat/safe-url-join

Conversation

@Techassi

@Techassi Techassi commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Port of the safe utility function from stackabletech/opa-operator#909.

This PR removes the unsafe and no longer needed UrlExt::join_many function. It additionally also disallows the use of Url::join workspace-wide. This rule can be copied over to operator-templating to enable this rule for all operators as well. The error message renders like this:

error: use of a disallowed method `url::Url::join`
   --> crates/stackable-operator/src/utils/url.rs:165:21
    |
165 |         let _ = url.join("https://evil.example.com/").unwrap();
    |                     ^^^^
    |
    = note: the function resolves its input as a URL, allowing bad actors to craft malicious inputs which replace the URL entirely or traverse the path; use UrlExt::join_safe instead
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.97.0/index.html#disallowed_methods
    = note: requested on the command line with `-D clippy::disallowed-methods`

This removes the unsafe and no longer needed UrlExt::join_many
function.

Co-authored-by: Lars Francke <git@lars-francke.de>
@Techassi Techassi self-assigned this Oct 29, 2026
@Techassi
Techassi marked this pull request as draft October 29, 2026 14:16
@Techassi Techassi moved this to Development: In Progress in Stackable Engineering Oct 29, 2026
@Techassi
Techassi marked this pull request as ready for review October 30, 2026 11:06
@Techassi Techassi moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Oct 30, 2026
@Maleware
Maleware self-requested a review November 2, 2026 10:06
@Maleware Maleware moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Nov 2, 2026
Maleware
Maleware previously approved these changes Nov 2, 2026

@Maleware Maleware left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you.

@Techassi
Techassi requested a review from Maleware November 2, 2026 10:49

@Maleware Maleware left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Techassi
Techassi added this pull request to the merge queue Nov 2, 2026
@Techassi Techassi moved this from Development: In Review to Development: Done in Stackable Engineering Nov 2, 2026
Merged via the queue into main with commit 1ba2592 Nov 2, 2026
5 checks passed
@Techassi
Techassi deleted the feat/safe-url-join branch November 2, 2026 11:07
@lfrancke lfrancke moved this from Development: Done to Done in Stackable Engineering Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Development

Successfully merging this pull request may close these issues.

2 participants