s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 32 Wiki Activity

ops: Assert Host allowlist reject in validate-check #55

Merged
eva merged 1 commits from ops/host-allowlist-reject-assert into main 2026-09-14 08:41:19 -05:00
Conversation 0 Commits 1 Files Changed 3
+25 -5

1 Commits

Author SHA1 Message Date
Blake 97af0f829b ops: Assert Host allowlist reject in validate-check
CI / vulncheck (pull_request) Successful in 16s
Details
CI / check-and-test (pull_request) Successful in 53s
Details
CI / vulncheck (push) Successful in 22s
Details
CI / check-and-test (push) Successful in 1m0s
Details
Release Tag / release (push) Successful in 15s
Details 
Empty-upstream Host allowlist is load-bearing: if that gate regresses,
the cache becomes an open LAN reverse proxy again. Unit tests already
cover hostAllowedForDirectFetch, but make validate-check did not probe
the live reject path.

Extend validate-check to GET a depot-like path with Host: evil.example
and a Steam User-Agent, requiring HTTP 400 Invalid URL. Document the
expected reject in README and the validate-config comment.

Fixes #37
 2026-09-14 13:39:32 +00:00