Documentation
¶
Overview ¶
Package urlallow is the single source of truth for the URL allowlist dotvault applies before handing a URL to an OS opener or a notification backend: an absolute http or https URL with a real host and no embedded credentials.
It exists so the two surfaces that gate a URL against an OS action — the remote-browse endpoint (internal/web) and the notification action link (internal/notify) — enforce byte-for-byte the same rule from one implementation. internal/web imports internal/notify, so notify could not import web to reuse its validator; a shared leaf package both import breaks that would-be cycle and keeps the "same allowlist" invariant the docs advertise actually enforced rather than duplicated.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Validate ¶
Validate enforces the allowlist: the value must parse as an absolute http or https URL with a host and no embedded user:pass@ credentials. Everything else — file://, custom protocol handlers (vscode:, ssh:), javascript:/data:, scheme-relative or bare paths, userinfo forms — is rejected, because the URL is handed to an OS opener (xdg-open / `open` / ShellExecute) or a native notification backend, which would otherwise dispatch a non-web scheme to an arbitrary local handler or carry credentials into the launcher and its logs. It returns the parsed URL so callers never re-parse (the canonical string form is u.String(), which lowercases the scheme and percent-encodes hostile characters). A leading/trailing space is trimmed; an empty input is an error.
Types ¶
This section is empty.
Source Files