Fix URL runtime evaluation.

integration/tests_failed/invalid_url_1.err

@@ -0,0 +1,7 @@
+error: Invalid URL
+  --> tests_failed/invalid_url_1.hurl:3:5
+   |
+ 3 | GET {{host}}
+   |     ^^^^^^^^ URL <localhost:8000> must start with http:// or https://
+   |
+

integration/tests_failed/invalid_url_1.exit

@@ -0,0 +1,2 @@
+3
+

integration/tests_failed/invalid_url_1.html

@@ -0,0 +1,5 @@
+<pre><code class="language-hurl"><span class="hurl-entry"><span class="request"><span class="line"></span><span class="comment"># We test that an URL should be valid (starts with http:// or https://)</span>
+<span class="line"></span><span class="comment"># even if injected through variable.</span>
+<span class="line"><span class="method">GET</span> <span class="url">{{host}}</span></span>
+</span></span><span class="line"></span>
+</code></pre>

integration/tests_failed/invalid_url_1.hurl

@@ -0,0 +1,4 @@
+# We test that an URL should be valid (starts with http:// or https://)
+# even if injected through variable.
+GET {{host}}
+

integration/tests_failed/invalid_url_1.json

@@ -0,0 +1 @@
+{"entries":[{"request":{"method":"GET","url":"{{host}}"}}]}

integration/tests_failed/invalid_url_1.ps1

@@ -0,0 +1,3 @@
+Set-StrictMode -Version latest
+$ErrorActionPreference = 'Stop'
+hurl --variable host=localhost:8000 tests_failed/invalid_url_1.hurl

integration/tests_failed/invalid_url_1.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -Eeuo pipefail
+hurl --variable host=localhost:8000 tests_failed/invalid_url_1.hurl

packages/hurl/src/http/error.rs

@@ -41,6 +41,7 @@ pub enum HttpError {
         description: String,
     },
     InvalidUrl(String),
+    InvalidUrlPrefix(String),
 }
 
 impl From<curl::Error> for HttpError {

packages/hurl/src/http/request.rs

@@ -68,17 +68,19 @@ impl Request {
             Ok(url) => url,
             Err(_) => return Err(HttpError::InvalidUrl(self.url.clone())),
         };
-        let base_url = format!(
-            "{}://{}{}",
-            url.scheme(),
-            url.host().unwrap(),
-            if let Some(port) = url.port() {
-                format!(":{port}")
-            } else {
-                "".to_string()
-            }
-        );
-        Ok(base_url)
+        let scheme = url.scheme();
+        if scheme != "http" && scheme != "https" {
+            return Err(HttpError::InvalidUrlPrefix(self.url.clone()));
+        }
+        let host = match url.host() {
+            Some(host) => host,
+            None => return Err(HttpError::InvalidUrl(self.url.clone())),
+        };
+        let port = match url.port() {
+            Some(port) => format!(":{port}"),
+            None => "".to_string(),
+        };
+        Ok(format!("{scheme}://{host}{port}"))
     }
 }
 

packages/hurl/src/runner/core.rs

@@ -119,6 +119,7 @@ pub enum RunnerError {
         value: String,
     },
     InvalidUrl(String),
+    InvalidUrlPrefix(String),
 
     HttpConnection {
         url: String,

packages/hurl/src/runner/error.rs

@@ -31,6 +31,7 @@ impl Error for runner::Error {
     fn description(&self) -> String {
         match &self.inner {
             RunnerError::InvalidUrl(..) => "Invalid URL".to_string(),
+            RunnerError::InvalidUrlPrefix(..) => "Invalid URL".to_string(),
             RunnerError::TemplateVariableNotDefined { .. } => "Undefined variable".to_string(),
             RunnerError::VariableNotDefined { .. } => "Undefined variable".to_string(),
             RunnerError::HttpConnection { .. } => "HTTP connection".to_string(),
@@ -75,6 +76,9 @@ impl Error for runner::Error {
     fn fixme(&self) -> String {
         match &self.inner {
             RunnerError::InvalidUrl(url) => format!("invalid URL <{url}>"),
+            RunnerError::InvalidUrlPrefix(url) => {
+                format!("URL <{url}> must start with http:// or https://")
+            }
             RunnerError::TemplateVariableNotDefined { name } => {
                 format!("you must set the variable {name}")
             }
@@ -203,6 +207,7 @@ impl From<HttpError> for RunnerError {
                 RunnerError::UnsupportedContentEncoding(description)
             }
             HttpError::InvalidUrl(url) => RunnerError::InvalidUrl(url),
+            HttpError::InvalidUrlPrefix(url) => RunnerError::InvalidUrlPrefix(url),
         }
     }
 }