cloudflare / cloudflare/workerd
🐛 Bug Report — fetch not checking if resolved redirect URL is http(s)
- Dominant language
- C++
- Stars
- 8.7k
- Forks
- 739
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 174
Description
Reproduction:
```
export default {
async fetch(req, env) {
if (req.url.endsWith('/sub')) {
return new Response("Hello World\n", {
status: 302, headers: {
location: 'file://what/is/the/url'
}
});
} else {
const resp = await fetch('http://localhost:8080/sub', { redirect: 'follow'});
console.log(resp.status);
console.log(resp.url);
return new Response("ok");
}
}
};
```
Expected result:
A useful error or proper network error response as defined by the spec
Actual result:
The runtime throws an "internal error" due to a triggered assert in `kj/compat/http.c++`
What's the issue:
In the initial request, the runtime will validate that the request URL is `http://` or `https://`, with additional special handling around `ws://` and `wss://` URLs. When a redirect response is processed and we generate a new request URL from the `location` header, we are not applying the same checks so we end up passing a non-http URL down to the kj http client, which fails with an assertion. We need to be properly validating the redirect url.
Contributor guide
Assessment
This issue has not been assessed yet.