Skip to content

feat(operator)!: Add UrlExt::join_safe function - #1319

Merged
Techassi merged 17 commits into
mainfrom
feat/safe-url-join
Nov 2, 2026
Merged

Techassi merged 17 commits into
mainfrom
feat/safe-url-join

Conversation

@Techassi

@Techassi Techassi commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Port of the safe utility function from stackabletech/opa-operator#909.

This PR removes the unsafe and no longer needed UrlExt::join_many function. It additionally also disallows the use of Url::join workspace-wide. This rule can be copied over to operator-templating to enable this rule for all operators as well. The error message renders like this:

error: use of a disallowed method `url::Url::join`
   --> crates/stackable-operator/src/utils/url.rs:165:21
    |
165 |         let _ = url.join("https://evil.example.com/").unwrap();
    |                     ^^^^
    |
    = note: the function resolves its input as a URL, allowing bad actors to craft malicious inputs which replace the URL entirely or traverse the path; use UrlExt::join_safe instead
    = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.97.0/index.html#disallowed_methods
    = note: requested on the command line with `-D clippy::disallowed-methods`

This removes the unsafe and no longer needed UrlExt::join_many
function.

Co-authored-by: Lars Francke <git@lars-francke.de>
@Techassi Techassi self-assigned this Oct 29, 2026
@Techassi
Techassi marked this pull request as draft October 29, 2026 14:16
@Techassi Techassi moved this to Development: In Progress in Stackable Engineering Oct 29, 2026
@Techassi
Techassi marked this pull request as ready for review October 30, 2026 11:06
@Techassi Techassi moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Oct 30, 2026
@Maleware
Maleware self-requested a review November 2, 2026 10:06
@Maleware Maleware moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Nov 2, 2026
Maleware
Maleware previously approved these changes Nov 2, 2026

@Maleware Maleware left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you.

@Techassi
Techassi requested a review from Maleware November 2, 2026 10:49

@Maleware Maleware left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Techassi
Techassi added this pull request to the merge queue Nov 2, 2026
@Techassi Techassi moved this from Development: In Review to Development: Done in Stackable Engineering Nov 2, 2026
Merged via the queue into main with commit 1ba2592 Nov 2, 2026
5 checks passed
@Techassi
Techassi deleted the feat/safe-url-join branch November 2, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Development: Done

Development

Successfully merging this pull request may close these issues.

2 participants