runtime/secrets: validate proxy URL scheme and length

cappyzawa · cappyzawa · commit c1274b13574a · 2025-10-07T01:51:25.000+09:00
Add validation to ProxyURLFromSecret to enforce scheme and length
restrictions that were previously enforced by CRD validation in
notification-controller's deprecated spec.proxy field.

The validation ensures:
- Only http or https schemes are accepted
- URL length does not exceed 2048 characters

The 2048 character limit matches the validation used in
notification-controller's spec.address field.

Signed-off-by: cappyzawa &lt;cappyzawa@gmail.com&gt;
diff --git a/runtime/secrets/converter.go b/runtime/secrets/converter.go
@@ -133,23 +133,34 @@ func TLSConfigFromSecret(ctx context.Context, secret *corev1.Secret, opts ...TLS
 // proxy URL. Optional "username" and "password" fields can be provided
 // for proxy authentication.
 func ProxyURLFromSecret(ctx context.Context, secret *corev1.Secret) (*url.URL, error) {
+	ref := client.ObjectKeyFromObject(secret)
+
 	addressData, exists := secret.Data[KeyAddress]
 	if !exists {
 		return nil, &KeyNotFoundError{Key: KeyAddress, Secret: secret}
 	}
 
 	address := string(addressData)
 	if address == "" {
-		ref := client.ObjectKeyFromObject(secret)
 		return nil, fmt.Errorf("secret '%s': proxy address is empty", ref)
 	}
 
+	// Validate length before parsing to avoid parsing large invalid URLs.
+	// The 2048 character limit matches the validation used in notification-controller's
+	// spec.address field.
+	if len(address) > 2048 {
+		return nil, fmt.Errorf("secret '%s': proxy URL exceeds maximum length of 2048 characters", ref)
+	}
+
 	proxyURL, err := url.Parse(address)
 	if err != nil {
-		ref := client.ObjectKeyFromObject(secret)
 		return nil, fmt.Errorf("secret '%s': failed to parse proxy address '%s': %w", ref, address, err)
 	}
 
+	if proxyURL.Scheme != "http" && proxyURL.Scheme != "https" {
+		return nil, fmt.Errorf("secret '%s': proxy URL must use http or https scheme, got '%s'", ref, proxyURL.Scheme)
+	}
+
 	username, hasUsername := secret.Data[KeyUsername]
 	password, hasPassword := secret.Data[KeyPassword]
 
diff --git a/runtime/secrets/converter_test.go b/runtime/secrets/converter_test.go
@@ -752,6 +752,36 @@ func TestProxyURLFromSecret(t *testing.T) {
 			),
 			errMsg: "secret 'default/proxy-secret': failed to parse proxy address",
 		},
+		{
+			name: "invalid scheme - ftp",
+			secret: testSecret(
+				withName("proxy-secret"),
+				withData(map[string][]byte{
+					secrets.KeyAddress: []byte("ftp://ftp.example.com:21"),
+				}),
+			),
+			errMsg: "secret 'default/proxy-secret': proxy URL must use http or https scheme, got 'ftp'",
+		},
+		{
+			name: "invalid scheme - no scheme",
+			secret: testSecret(
+				withName("proxy-secret"),
+				withData(map[string][]byte{
+					secrets.KeyAddress: []byte("proxy.example.com:8080"),
+				}),
+			),
+			errMsg: "secret 'default/proxy-secret': proxy URL must use http or https scheme",
+		},
+		{
+			name: "URL exceeds maximum length",
+			secret: testSecret(
+				withName("proxy-secret"),
+				withData(map[string][]byte{
+					secrets.KeyAddress: []byte("http://proxy.example.com/" + string(make([]byte, 2049))),
+				}),
+			),
+			errMsg: "secret 'default/proxy-secret': proxy URL exceeds maximum length of 2048 characters",
+		},
 	}
 
 	for _, tt := range tests {
