incorrect outbound http validation blocks request if url contains '@'

[rajatjindal]

I am trying to debug an issue with one of my spin app, and it seems like spin incorrectly blocks the outbound request if the url contains '@'

here is how my outbound http config looks like in spin.toml:

allowed_outbound_hosts = ["https://api.github.com", "https://github.com"]

and

the url I am trying to make request to is : https://api.github.com/repos/rajatjindal/spin-plugins/contents/manifests/kube/kube@0.2.0.json?ref=heads%2Fkube-v0.2.0

On trying to make this request, following error is thrown:

2024-11-05T02:13:16.254329Z ERROR spin_runtime_factors: Outbound network destination not allowed: https://0.2.0.json
Warning: A component tried to make an outbound network connection to disallowed destination 'https://0.2.0.json'.
To allow this request, add 'allowed_outbound_hosts = ["https://0.2.0.json"]' to the manifest component section.
Handler returned an error: Error::UnexpectedError("ErrorCode::HttpRequestDenied")

The source code for this sample can be found at: https://github.com/rajatjindal/spin-outbound-http-issue/

[rajatjindal]

yeah, it seems we may need to handle this here: https://github.com/fermyon/spin/blob/4441c8cf277ab13b94a4362fde4b78fe7601493d/crates/factor-outbound-networking/src/config.rs#L444C37-L444C38

[itowlson]

I think the issue is at https://github.com/itowlson/spin/blob/55ce36e2895a04822fcf47ad329a3ea9ae767adf/crates/factor-outbound-networking/src/config.rs#L446. It's trying to handle the presence of a username:password@host prefix, but encodes too much of the URL when the @ is in the path or query.

[rajatjindal]

Hi @itowlson, thank you for your super quick turnaround. Assuming this can be fixed/merged soon, do you have a rough idea on when we can expect this fix in Fermyon Cloud?

Thanks again

[itowlson]

I'm not sure of timings for Fermyon Cloud, sorry. I can try to take a look if the fix is approved but can't promise anything as there's a bunch of other stuff happening around Spin 3.

[rajatjindal]

I'm not sure of timings for Fermyon Cloud, sorry. I can try to take a look if the fix is approved but can't promise anything as there's a bunch of other stuff happening around Spin 3.

sure, no problem. thank you.