s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues Pull requests Projects Releases 34 Packages Wiki Activity Actions

ops: Assert Host allowlist reject in validate-check #55

Merged
eva merged 1 commit from ops/host-allowlist-reject-assert into main 2026-09-14 13:41:19 +00:00
Conversation 0 Commits 1 Files changed 3 +25 -5
blake commented 2026-09-14 13:39:38 +00:00
Collaborator
Copy link

Why

Empty-upstream Host allowlist is load-bearing: if that gate regresses, the cache becomes an open LAN reverse proxy again. Unit tests already cover hostAllowedForDirectFetch, but make validate-check did not probe the live reject path.

What

  • Extend make validate-check to GET /depot/allowlist-probe/chunk with Host: evil.example and Steam UA; require HTTP 400 and Invalid URL
  • Brief README + validate-config notes on expected reject behavior

Test

  • go test ./steamcache/ -run "TestHostAllowedForDirectFetch|TestDirectFetchRejectsNonSteamHost" — pass
  • Live probe against empty-upstream binary on ephemeral port — 400 Invalid URL

Risks / rollback

Makefile + docs only. Revert commit.

Fixes #37

## Why Empty-upstream Host allowlist is load-bearing: if that gate regresses, the cache becomes an open LAN reverse proxy again. Unit tests already cover `hostAllowedForDirectFetch`, but `make validate-check` did not probe the live reject path. ## What - Extend `make validate-check` to GET `/depot/allowlist-probe/chunk` with `Host: evil.example` and Steam UA; require HTTP 400 and `Invalid URL` - Brief README + validate-config notes on expected reject behavior ## Test - `go test ./steamcache/ -run "TestHostAllowedForDirectFetch|TestDirectFetchRejectsNonSteamHost"` — pass - Live probe against empty-upstream binary on ephemeral port — 400 Invalid URL ## Risks / rollback Makefile + docs only. Revert commit. Fixes #37
ops: Assert Host allowlist reject in validate-check
All checks were successful
CI / vulncheck (pull_request) Successful in 16s
Details
CI / check-and-test (pull_request) Successful in 53s
Details
CI / vulncheck (push) Successful in 22s
Details
CI / check-and-test (push) Successful in 1m0s
Details
Release Tag / release (push) Successful in 15s
Details
97af0f829b 
Empty-upstream Host allowlist is load-bearing: if that gate regresses,
the cache becomes an open LAN reverse proxy again. Unit tests already
cover hostAllowedForDirectFetch, but make validate-check did not probe
the live reject path.

Extend validate-check to GET a depot-like path with Host: evil.example
and a Steam User-Agent, requiring HTTP 400 Invalid URL. Document the
expected reject in README and the validate-config comment.

Fixes #37
eva merged commit 97af0f829b into main 2026-09-14 13:41:19 +00:00
eva deleted branch ops/host-allowlist-reject-assert 2026-09-14 13:41:19 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
blocked
Stuck. The assignee needs a decision or an unblock; see the latest comment.

  
bug
Something is not working

  
draft
Draft for review — do not merge without Eva review

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
blocked
bug
draft
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
s1d3sw1ped/steamcache2!55
No description provided.