File tree Expand file tree Collapse file tree 1 file changed +12
-12
lines changed
crates/factor-outbound-http/src Expand file tree Collapse file tree 1 file changed +12
-12
lines changed Original file line number Diff line number Diff line change @@ -19,7 +19,18 @@ impl spin_http::Host for crate::InstanceState {
1919 let uri = req. uri ;
2020 tracing:: trace!( "Sending outbound HTTP to {uri:?}" ) ;
2121
22- let abs_url = if uri. starts_with ( '/' ) {
22+ let abs_url = if !uri. starts_with ( '/' ) {
23+ // Absolute URI
24+ let is_allowed = self
25+ . allowed_hosts
26+ . check_url ( & uri, "https" )
27+ . await
28+ . unwrap_or ( false ) ;
29+ if !is_allowed {
30+ return Err ( HttpError :: DestinationNotAllowed ) ;
31+ }
32+ uri
33+ } else {
2334 // Relative URI ("self" request)
2435 let is_allowed = self
2536 . allowed_hosts
@@ -37,17 +48,6 @@ impl spin_http::Host for crate::InstanceState {
3748 return Err ( HttpError :: InvalidUrl ) ;
3849 } ;
3950 format ! ( "{origin}{uri}" )
40- } else {
41- // Absolute URI
42- let is_allowed = self
43- . allowed_hosts
44- . check_url ( & uri, "https" )
45- . await
46- . unwrap_or ( false ) ;
47- if !is_allowed {
48- return Err ( HttpError :: DestinationNotAllowed ) ;
49- }
50- uri
5151 } ;
5252 let req_url = reqwest:: Url :: parse ( & abs_url) . map_err ( |_| HttpError :: InvalidUrl ) ?;
5353
You can’t perform that action at this time.
0 commit comments