From 232bf4fcaccffb2a4400e6c317823ba2ec90a0f8 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Mon, 31 Aug 2026 16:47:59 +0200 Subject: [PATCH] fix: warn on an unclosed ipv6 host in the origins advisory --- frontend/src/lib/components/triggers/http/utils.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/frontend/src/lib/components/triggers/http/utils.ts b/frontend/src/lib/components/triggers/http/utils.ts index 377d319d3b..ed03ef86aa 100644 --- a/frontend/src/lib/components/triggers/http/utils.ts +++ b/frontend/src/lib/components/triggers/http/utils.ts @@ -83,6 +83,10 @@ export function allowedOriginWarning(origin: string): string | undefined { // and IPv6 literals among them, and a warning that cries wolf on a working // origin is worse than one that stays quiet. if (rest.startsWith(':')) return `'${origin}' has no host` + // An unclosed bracket would otherwise leave `portStart` at zero, which reads + // as "no port" and lets the entry through unremarked. + if (rest.startsWith('[') && !rest.includes(']')) + return `'${origin}' has an unclosed IPv6 host` const portStart = rest.startsWith('[') ? rest.indexOf(']') + 1 : rest.indexOf(':') // A trailing colon is a port, an empty one — distinct from having none. const port = portStart > 0 && rest[portStart] === ':' ? rest.slice(portStart + 1) : undefined