[10.2][hdrs] URL authority parser accepts non-digit trailing characters in port

Branch: 10.2.x (10.2.1, commit 31f1f2f3b) · Severity: medium · category: logic-bug
Location: src/proxy/hdrs/URL.cc:479 (parse), port extraction at :1376-1383

What's wrong

url_parse_internet() extracts the port substring as everything between the last colon and the authority terminator (/, ?, #, or EOS) without validating it is all digits, and never runs it through the digit-strict validation used for the Host header. A port like 8080abc is accepted; the numeric port and the stored port text can then disagree, which is a cache-key / routing consistency hazard and a parser-differential risk versus stricter upstreams.

Suggested fix

Validate the port TextView is non-empty and all digits in url_parse_internet() (mirroring http_parse_host_header) and return ParseResult::ERROR otherwise; or reject in set_port().

Why tracked, not yet a PR

This tightens URL parsing acceptance, which can affect existing autests and real traffic patterns; it should land with the end-to-end autest suite run (not available in the audit environment). Filing for a maintainer to apply with proper test coverage.

From an automated multi-lens audit of the 10.2.x branch. Full report on branch claude/codebase-audit-review-9nw7vz (CODEBASE_AUDIT_10.2.md).

Start in src/proxy/hdrs/URL.cc at url_parse_internet() around line 479 and compare its port extraction with the digit-strict validation in http_parse_host_header around lines 1376-1383. Confirm that malformed ports are rejected with ParseResult::ERROR, add or update focused coverage, and run the end-to-end autest suite to verify the parser change.