Skip to content

feat(operator)!: Add UrlExt::join_safe function - #1319

Open
Techassi wants to merge 15 commits into
mainfrom
feat/safe-url-join
Open

Techassi wants to merge 15 commits into
mainfrom
feat/safe-url-join

Conversation

@Techassi

@Techassi Techassi commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Port of the safe utility function from stackabletech/opa-operator#909.

This PR removes the unsafe and no longer needed UrlExt::join_many function. It additionally also disallows the use of Url::join workspace-wide. This rule can be copied over to operator-templating to enable this rule for all operators as well. The error message renders like this:

error: use of a disallowed method `url::Url::join`
   --> crates/stackable-operator/src/utils/url.rs:165:21
    |
165 |         let _ = url.join("https://evil.example.com/").unwrap();
    |                     ^^^^
    |
    = note: the function resolves its input as a URL, allowing bad actors to craft malicious inputs which replace the URL entirely or traverse the path; use UrlExt::join_safe instead
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.97.0/index.html#disallowed_methods
    = note: requested on the command line with `-D clippy::disallowed-methods`

This removes the unsafe and no longer needed UrlExt::join_many
function.

Co-authored-by: Lars Francke <git@lars-francke.de>
@Techassi Techassi self-assigned this Oct 29, 2026
@Techassi
Techassi marked this pull request as draft October 29, 2026 14:16
@Techassi Techassi moved this to Development: In Progress in Stackable Engineering Oct 29, 2026
@Techassi
Techassi marked this pull request as ready for review October 30, 2026 11:06
@Techassi Techassi moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Oct 30, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Development: Waiting for Review

Development

Successfully merging this pull request may close these issues.

1 participant