Function assertSafeGitLabHostString

apps/sim/tools/gitlab/utils.ts:26–38

* Rejects a host that is structurally unsafe to fetch with the caller's token. * * The host is later interpolated into `https:// /api/v4`, so anything that * could change the request's authority (userinfo `@`, an embedded path/query/ * fragment, whitespace, or control characters) must be re

(host: string, rawHost: string)

 * responsibility of the fetch layer.
 */
function assertSafeGitLabHostString(host: string, rawHost: string): void {
  const hostnameWithoutPort = host.replace(/:\d+$/, '')
  const allowedHostChars = /^[A-Za-z0-9.-]+$/
  if (!allowedHostChars.test(hostnameWithoutPort)) {
    throw new UnsafeGitLabHostError(rawHost)
  }
  if (hostnameWithoutPort.startsWith('.') || hostnameWithoutPort.endsWith('.')) {
    throw new UnsafeGitLabHostError(rawHost)
  }
  if (hostnameWithoutPort.split('.').some((label) => label.length === 0)) {
    throw new UnsafeGitLabHostError(rawHost)
  }
}

/**
 * Normalizes a GitLab host value: trims whitespace, strips any protocol prefix