Fix bug #16: block localhost-with-port in isBadServerName
Only the exact string "localhost" was denied; "localhost:8080" has one
colon (allowed as host:port), matched no prefix or suffix rule, and slipped
through to a loopback fetch. (The 127.x:port form was already caught by the
"127." prefix.)
commitfbf23aa8dfca165bb928a39a8791420a9e6fd48d
authoriko <mail@iko.soy>
dateThu 11 Jun 2026, 13:59 (4 months ago)
parentae2c0ac
server.knot+1−1
@@ -411,7 +411,7 @@ else (if take 1 s == c then 1 else 0) + countChar c (drop 1 s)
411411-- A legitimate `host:port` server name has exactly one `:`, so the multi-colon
412412-- check leaves that case intact.
413413isBadServerName : Text -> Bool
414−isBadServerName = \sn -> sn == "" || sn == "localhost" || any (\c -> not contains c "0123456789abcdefghijklmnopqrstuvwxyz-.:") (chars sn) || countChar ":" sn > 1 || any (\p -> hasPrefix p sn) [
414+isBadServerName = \sn -> sn == "" || sn == "localhost" || hasPrefix "localhost:" sn || any (\c -> not contains c "0123456789abcdefghijklmnopqrstuvwxyz-.:") (chars sn) || countChar ":" sn > 1 || any (\p -> hasPrefix p sn) [
415415 ".",
416416 ":",
417417 "[",