Skip to content

fix: make "file://" fail url validation #1444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 2, 2025
Merged

fix: make "file://" fail url validation #1444

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 2 additions & 14 deletions baked_in.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,15 +258,15 @@
func parseOneOfParam2(s string) []string {
oneofValsCacheRWLock.RLock()
vals, ok := oneofValsCache[s]
oneofValsCacheRWLock.RUnlock()

Check failure on line 261 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (no shared variables above expr) (wsl_v5)
if !ok {

Check failure on line 262 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (invalid statement above if) (wsl_v5)
oneofValsCacheRWLock.Lock()
vals = splitParamsRegex().FindAllString(s, -1)
for i := 0; i < len(vals); i++ {
vals[i] = strings.ReplaceAll(vals[i], "'", "")
}
oneofValsCache[s] = vals

Check failure on line 268 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (invalid statement above assign) (wsl_v5)
oneofValsCacheRWLock.Unlock()

Check failure on line 269 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (no shared variables above expr) (wsl_v5)
}
return vals
}
Expand Down Expand Up @@ -304,7 +304,7 @@
return true
}
}
return false

Check failure on line 307 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (too many lines above return) (wsl_v5)
}

// isOneOfCI is the validation function for validating if the current field's value is one of the provided string values (case insensitive).
Expand Down Expand Up @@ -358,11 +358,11 @@

m := reflect.MakeMap(reflect.MapOf(sfTyp, v.Type()))
var fieldlen int
for i := 0; i < field.Len(); i++ {

Check failure on line 361 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (no shared variables above for) (wsl_v5)
key := reflect.Indirect(reflect.Indirect(field.Index(i)).FieldByName(param))
if key.IsValid() {
fieldlen++
m.SetMapIndex(key, v)

Check failure on line 365 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

missing whitespace above this line (no shared variables above expr) (wsl_v5)
}
}
return fieldlen == m.Len()
Expand Down Expand Up @@ -1461,15 +1461,6 @@
panic(fmt.Sprintf("Bad field type %s", field.Type()))
}

// isFileURL is the helper function for validating if the `path` valid file URL as per RFC8089
func isFileURL(path string) bool {
if !strings.HasPrefix(path, "file:/") {
return false
}
_, err := url.ParseRequestURI(path)
return err == nil
}

// isURL is the validation function for validating if the current field's value is a valid URL.
func isURL(fl FieldLevel) bool {
field := fl.Field()
Expand All @@ -1483,16 +1474,13 @@
return false
}

if isFileURL(s) {
return true
}

url, err := url.Parse(s)
if err != nil || url.Scheme == "" {
return false
}
isFileScheme := url.Scheme == "file"

if url.Host == "" && url.Fragment == "" && url.Opaque == "" {
if (isFileScheme && (len(url.Path) == 0 || url.Path == "/")) || (!isFileScheme && len(url.Host) == 0 && len(url.Fragment) == 0 && len(url.Opaque) == 0) {
return false
}

Expand Down Expand Up @@ -1652,7 +1640,7 @@
if strings.HasSuffix(field.String(), string(os.PathSeparator)) {
return false
}
if _, err = os.Stat(field.String()); err != nil {

Check failure on line 1643 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

avoid inline error handling using `if err := ...; err != nil`; use plain assignment `err := ...` (noinlineerr)
switch t := err.(type) {
case *fs.PathError:
if t.Err == syscall.EINVAL {
Expand Down Expand Up @@ -2650,7 +2638,7 @@
if strings.TrimSpace(field.String()) == "" {
return false
}
if _, err = os.Stat(field.String()); err != nil {

Check failure on line 2641 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

avoid inline error handling using `if err := ...; err != nil`; use plain assignment `err := ...` (noinlineerr)
switch t := err.(type) {
case *fs.PathError:
if t.Err == syscall.EINVAL {
Expand Down Expand Up @@ -2718,7 +2706,7 @@
return false
}
// Port must be a iny <= 65535.
if portNum, err := strconv.ParseInt(

Check failure on line 2709 in baked_in.go

View workflow job for this annotation

GitHub Actions / lint 

avoid inline error handling using `if err := ...; err != nil`; use plain assignment `err := ...` (noinlineerr)
port, 10, 32,
); err != nil || portNum > 65535 || portNum < 1 {
return false
Expand Down
4 changes: 3 additions & 1 deletion validator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8255,7 +8255,9 @@ func TestUrl(t *testing.T) {
{"file:///c:/Windows/file.txt", true},
{"file://localhost/path/to/file.txt", true},
{"file://localhost/c:/WINDOWS/file.txt", true},
{"file://", true},
{"file:", false},
{"file:/", false},
{"file://", false},
{"file:////remotehost/path/file.txt", true},
}

Expand Down