[jwrosewell]

Problem

Two follow-ups to the callback URL check in #31, from the shared rules in specifications#74.

1. No test held a bad IPv6 zone or anything after ]. The check refuses both, in _checked_host_port in pipeline/fiftyone_pipeline_core/src/fiftyone_pipeline_core/callback_url.py, but none of the refused hosts held %25 or text after the closing bracket. The zone check is what keeps a quote out of the script for a bracketed host, so if it went, [fe80::1%25'+alert(1)+'] would reach the script and every test would still pass. The same was true of a port read by its value and of the characters rule 8 encodes.
2. Rule 1 now allows only http and https. The script posts to the callback URL only with fetch and XMLHttpRequest, and the Fetch Standard's scheme fetch gives every other scheme a network error or keeps it local, so a callback URL with any other scheme could never work. The check accepted any RFC 3986 scheme, such as ftp.

Change

• callback_url.py accepts only http and https, compared after lower-casing the ASCII letters A to Z only. A comparison that ignores case in general can match a letter outside ASCII to an ASCII one, for example the long s (U+017F) to s, which would let httpſ pass as https and then fail in the browser.
• A protocol from the header.protocol evidence that is neither gives a script with no callback, and is logged once like any other URL that is not valid (rule 6).
• A protocol given to the builder is used for every request, so JavascriptBuilderElement now raises a ValueError when it is made with any other protocol, as it already does for an object name that is not valid.
• The tests carry the shared cases from the Rust implementation's tests at d3c82cf, which specifications#74 points at:
  • eight hosts with a bad zone or text after ], and a zone followed by a port,
  • ports read by their value (:00080 and :0065535 accepted, :0065536 and longer refused),
  • each character rule 8 encodes, in the user information, after the host and in the endpoint, and a % at the end,
  • the schemes, with ftp, h+t-p.s and httpſ now refused, a configured protocol refused, and a refused protocol from the request logged once.

Release note

• The JavaScript builder writes a callback URL only for the http and https protocols, in any case of their ASCII letters. A protocol from the request that is neither gives no callback and is logged once. A protocol configured on the builder that is neither raises a ValueError.

How it was checked

The full build with macOS is linked below once it has run.