(rawURL string)
| 187 | } |
| 188 | |
| 189 | func validateMetadataURL(rawURL string) (string, error) { |
| 190 | parsed, err := url.Parse(rawURL) |
| 191 | if err != nil { |
| 192 | return "", fmt.Errorf("invalid URL: %w", err) |
| 193 | } |
| 194 | |
| 195 | if parsed.Scheme != "https" { |
| 196 | return "", fmt.Errorf("unsupported URL scheme %q", parsed.Scheme) |
| 197 | } |
| 198 | |
| 199 | host := parsed.Hostname() |
| 200 | if host == "" { |
| 201 | return "", fmt.Errorf("missing URL host") |
| 202 | } |
| 203 | |
| 204 | if _, ok := allowedMetadataHosts[strings.ToLower(host)]; !ok { |
| 205 | return "", fmt.Errorf("unsupported metadata host %q", host) |
| 206 | } |
| 207 | |
| 208 | if ip := net.ParseIP(host); ip != nil { |
| 209 | return "", fmt.Errorf("IP hosts are not allowed") |
| 210 | } |
| 211 | |
| 212 | return parsed.String(), nil |
| 213 | } |
| 214 | |
| 215 | func buildScriptPath(scriptType, slug string) string { |
| 216 | switch scriptType { |
no test coverage detected