- Notifications
You must be signed in to change notification settings - Fork928
Assignees
Description
The issue can be demonstrated easily:
~❯ curl https://dev.coder.com/api/v2/buildinfo{"external_url":"https://github.com/coder/coder/commit/6f0e2a79683d30c2974fbe9cda5802f0b7c47d44","version":"v2.1.5-devel+6f0e2a796","dashboard_url":"https://dev.coder.com","workspace_proxy":false}vs
~❯ curl https://dev.coder.com//api/v2/buildinfo<!doctype html><!-- ▄█▀ ▀█▄ ▄▄ ▀▀▀ █▌ ██▀▀█▄ ▐█ ▄▄██▀▀█▄▄▄ ██ ██ █▀▀█ ▐█▀▀██ ▄█▀▀█ █▀▀█▌ ▄▌ ▐█ █▌ ▀█▄▄▄█▌ █ █ ▐█ ██ ██▀▀ █ ██████▀▄█ ▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀ ▀▀▀▀ ▀ --><head>This could probably be considered a non-bug, but I'm reporting it as a bug. It's not an uncommon scenario when concatenating URLs (ran into this in#9852) that we could handle. Perhaps we can sanitize all (or at least most)// to/?