From bb17ff3abefe7a165a696aa4cd9613d9f8b7323b Mon Sep 17 00:00:00 2001
From: Ashutosh0x <ashutoshkumarsingh0x@gmail.com>
Date: Fri, 7 Aug 2026 16:06:38 +0530
Subject: [PATCH] fix: reject unsupported URLs before Gmail fallthrough in
 Google Gatekeeper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

getGatekeeperClassFor() falls through to the Gmail branch for any URL
that does not match Docs, Sheets, Calendar, or BigQuery — including
non-Google URLs like https://evil.example/resource. This silently
returns a Gmail capability for an unrelated resource URL.

Add a hostname check for mail.google.com before the fallthrough so
unsupported URLs are rejected with a clear error.

Fixes #63
---
 packages/gatekeeper-google/src/google.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/packages/gatekeeper-google/src/google.ts b/packages/gatekeeper-google/src/google.ts
index 742dc530..a4d2414c 100644
--- a/packages/gatekeeper-google/src/google.ts
+++ b/packages/gatekeeper-google/src/google.ts
@@ -927,6 +927,15 @@ export class GatekeeperUserImpl extends WorkerEntrypoint<Env, GatekeeperUserImpl
       };
     }
 
+    // Reject URLs that don't belong to Gmail before falling through to the default.
+    // Without this check, any URL that doesn't match Docs/Sheets/Calendar/BigQuery
+    // silently receives a Gmail capability, which weakens the resource-URL boundary.
+    if (parsed.hostname !== "mail.google.com") {
+      throw new Error(
+        `Unsupported Google resource URL: ${parsed.hostname}${parsed.pathname}. ` +
+        "Supported resources are Google Docs, Sheets, Calendar, BigQuery, and Gmail.");
+    }
+
     // Default: Gmail
     let props: GmailGatekeeperImplProps = {...this.ctx.props};