cloudflare / cloudflare/workerd

🐛 Bug Report — fetch not checking if resolved redirect URL is http(s)

Open
#2,100 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.7k
Forks
739
Avg merge
2d 20h
Merged PRs (30d)
174

Description

Reproduction:

```
export default {
async fetch(req, env) {
if (req.url.endsWith('/sub')) {
return new Response("Hello World\n", {
status: 302, headers: {
location: 'file://what/is/the/url'
}
});
} else {
const resp = await fetch('http://localhost:8080/sub', { redirect: 'follow'});
console.log(resp.status);
console.log(resp.url);
return new Response("ok");
}
}
};
```

Expected result:

A useful error or proper network error response as defined by the spec

Actual result:

The runtime throws an "internal error" due to a triggered assert in `kj/compat/http.c++`

What's the issue:

In the initial request, the runtime will validate that the request URL is `http://` or `https://`, with additional special handling around `ws://` and `wss://` URLs. When a redirect response is processed and we generate a new request URL from the `location` header, we are not applying the same checks so we end up passing a non-http URL down to the kj http client, which fails with an assertion. We need to be properly validating the redirect url.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.