fix(validate): check where a host is REQUESTED, not merely mentioned - #109

Merged

pitimon merged 10 commits into

mainfrom

fix/101-sink-detection

Jul 25, 2026

Commits on Jul 25, 2026

fix(validate): check where a host is REQUESTED, not merely mentioned
itarun.p
committed
fix(validate): close three evasions found by attacking the check
itarun.p
committed
fix(validate): a backslash ends the authority, and a trailing dot is a host
itarun.p
committed
fix(privacy): the README was certifying a false sentence
itarun.p
committed
fix(validate): percent-encoding in the authority could borrow a permitted host
itarun.p
committed
fix(validate): stop hand-parsing URLs; use the parser the runtime uses
itarun.p
committed
chore(validate): drop percentDecode, made redundant by the URL parser
itarun.p
committed
fix(security): the avatar proxy followed redirects off its own allowlist
itarun.p
committed
fix(security): the avatar allowlist checked the host but not the port
itarun.p
committed
test: name the address-guard test for what it actually asserts
itarun.p
committed