[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_179":-5,"_182":183,"_184":185},"routes/shell",{"_41":42,"_178":-5,"_179":-5,"_180":181},"routes/repo",{"_34":-7,"_35":36,"_37":38,"_39":40,"_41":42,"_43":32,"_44":32,"_45":32,"_46":32,"_47":32,"_48":32,"_49":50,"_51":50,"_52":32,"_53":-7,"_54":-7,"_55":56,"_57":58,"_59":60,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5,"_26":27,"_28":29,"_29":30,"_31":32,"_33":14},"ref","main","path","crates/logic/http.rs","oid","de1901a66de5de771ba821576ace0cd496c0b791","size",10268,"commit","90b43017241f81189453d326d05948f388b34652","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","// Copyright 2026 Deno Land Inc. Apache-2.0 license.\n\n//! HTTP predicates, reified sans-IO.\n//!\n//! A Worker reads `request.url`, and celld builds that URL from a request\n//! header. The header is client-controlled whenever no proxy sits in front, so\n//! the shape of the authority is a SECURITY fence, exactly as\n//! `cell::valid_cell_scope`'s is. celld interpolates the authority into\n//! `://`, so a character that is structural\n//! in a URL moves the boundary between the parts.\n//!\n//! The gate checks the structure as well as the charset. celld carries the URL\n//! to the Worker as a string and never parses it, so an authority a URL parser\n//! refuses reaches the application intact. `new URL(request.url)` is how a\n//! Worker reads its own path and query, and that call then throws: a `Host` of\n//! `a]b` gives `TypeError: Invalid URL`. A client therefore turns every request\n//! into an application error, so a shape like `a]b` or `999.1.1.1` has to fail\n//! here rather than inside the isolate.\n\nuse std::net::Ipv6Addr;\n\n/// The longest authority celld accepts. A hostname is at most 253 bytes and can\n/// carry the root dot, and a port adds at most 6 more — a `:` and five digits —\n/// so this admits every legal value and bounds what one request can make the\n/// URL parser allocate.\npub const MAX_AUTHORITY: usize = 260;\n\n/// The largest port a URL parser accepts.\nconst MAX_PORT: u32 = 65535;\n\n/// The complete sans-IO decision for an authority in `request.url`.\n#[derive(Clone, Copy, Debug, Eq, PartialEq)]\n#[must_use]\npub enum AuthorityDecision<'a> {\n /// The authority cannot be installed in `request.url`.\n Reject,\n /// The authority is safe to install without another check.\n Use(&'a str),\n /// The authority has valid syntax, but a URL parser must validate its IDN.\n NeedsUrlParser(&'a str),\n}\n\n/// Classify an authority before celld installs it in `request.url`.\n///\n/// The result carries the authority with the decision, so a caller cannot use\n/// a partial syntax result as a validated value.\npub fn authority_decision(authority: &str) -> AuthorityDecision<'_> {\n if !valid_authority(authority) {\n AuthorityDecision::Reject\n } else if has_idn_label(authority) {\n AuthorityDecision::NeedsUrlParser(authority)\n } else {\n AuthorityDecision::Use(authority)\n }\n}\n\n/// Does a URL authority have valid syntax? An optional port after either a\n/// bracketed IPv6 address or a registered name, and at most `MAX_AUTHORITY`\n/// bytes.\n///\n/// The charset of the name is the first fence, and it excludes every character\n/// that is structural in a URL. `/` starts a path, `?` starts a query, `#`\n/// starts a fragment, and `@` ends userinfo — so each one lets a client move\n/// the rest of the URL into a different component. A `Host: evil.example#`\n/// header on a request for `/admin` makes `request.url` read\n/// `http://evil.example#/admin`, where the real path becomes a fragment. celld\n/// dispatches on the request target, so the Worker then reads a path celld did\n/// not route, inside one process.\n///\n/// Whitespace and control bytes are excluded because they make the URL\n/// unparseable rather than merely wrong. Non-ASCII is excluded because a\n/// hostname reaches celld in its A-label form.\n///\n/// The structure is the second fence, because a charset alone admits shapes a\n/// URL parser refuses: `a]b`, `::1` and `999.1.1.1` carry no character that\n/// reshapes a URL, and each one makes `new URL(request.url)` throw in the\n/// Worker. So `[` and `]` are admitted only as a matched pair that wraps a whole\n/// IPv6 address, `:` only once outside that pair, where it separates a port that\n/// must be a number in range, and a name that ends in a number must be an IPv4\n/// address. `_` is admitted in a name because it occurs in practice in internal\n/// hostnames.\n///\n/// This predicate does not check that the authority is a hostname celld serves.\n/// `authority_decision` combines this syntax result with the IDN decision, so\n/// callers cannot install the partial result by itself.\nfn valid_authority(authority: &str) -> bool {\n if authority.is_empty() || authority.len() > MAX_AUTHORITY {\n return false;\n }\n // An IPv6 address is the one shape where a `:` is not the port separator,\n // so the brackets are matched first and a port can only follow the closing\n // one.\n let after_host = if let Some(tail) = authority.strip_prefix('[') {\n let Some((literal, after_host)) = tail.split_once(']') else {\n return false;\n };\n if literal.parse::().is_err() {\n return false;\n }\n after_host\n } else {\n let (name, after_host) = authority.split_at(authority.find(':').unwrap_or(authority.len()));\n if !valid_reg_name(name) {\n return false;\n }\n after_host\n };\n match after_host.strip_prefix(':') {\n Some(port) => valid_port(port),\n None => after_host.is_empty(),\n }\n}\n\n/// A registered name: non-empty ASCII alphanumerics plus `_ - .`, and an IPv4\n/// address whenever it reads as one.\n///\n/// A URL parser stops treating a name as a name as soon as the last label is a\n/// number, and reads the whole name as an IPv4 address instead. So a name that\n/// merely looks numeric at the end is not a name that parses: `999.1.1.1`,\n/// `1.2.3.4.5` and `foo.1` each fail the address parse, and the URL therefore\n/// fails with them. Every such name is refused here.\n///\n/// The check on an address is stricter than the parser is, and deliberately so.\n/// A parser reads `010.1.1.1` as octal and `0x7f.1` as hex, so both name a\n/// different host than the text does, and `1234567890` names a fourth host\n/// again. celld refuses all three rather than hand a Worker a URL whose host is\n/// not the host the string shows. An address must therefore be four decimal\n/// labels, each at most 255 and none carrying a leading zero.\nfn valid_reg_name(name: &str) -> bool {\n if name.is_empty()\n || !name\n .bytes()\n .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'.'))\n {\n return false;\n }\n // A single root dot ends a fully-qualified name, and the parser reads the\n // label before it as the last one.\n let labels = name.strip_suffix('.').unwrap_or(name);\n match labels.rsplit('.').next() {\n Some(last) if reads_as_number(last) => {\n let mut octets = labels.split('.');\n let address = [octets.next(), octets.next(), octets.next(), octets.next()];\n octets.next().is_none() && address.iter().all(|octet| octet.is_some_and(valid_octet))\n }\n _ => true,\n }\n}\n\n/// Does this label make a URL parser read the whole name as an IPv4 address? It\n/// does when the label is decimal, and when it is hexadecimal with the `0x`\n/// prefix the parser accepts.\nfn reads_as_number(label: &str) -> bool {\n let hex = label\n .strip_prefix(\"0x\")\n .or_else(|| label.strip_prefix(\"0X\"));\n match hex {\n Some(digits) => digits.bytes().all(|b| b.is_ascii_hexdigit()),\n None => !label.is_empty() && label.bytes().all(|b| b.is_ascii_digit()),\n }\n}\n\n/// One decimal octet of an IPv4 address: at most 255, and no leading zero,\n/// which a parser would read as octal.\nfn valid_octet(octet: &str) -> bool {\n !octet.is_empty()\n && octet.bytes().all(|b| b.is_ascii_digit())\n && (octet == \"0\" || !octet.starts_with('0'))\n && octet.parse::().is_ok_and(|octet| octet <= 255)\n}\n\n/// A port: decimal digits, and a number at most `MAX_PORT`. Leading zeros pass\n/// because a parser reads the number and not the text, and both name the same\n/// port. An empty port is refused, though a parser reads `host:` as `host`,\n/// because a header that carries a bare `:` is malformed at the source.\nfn valid_port(port: &str) -> bool {\n !port.is_empty()\n && port.bytes().all(|b| b.is_ascii_digit())\n && port.parse::().is_ok_and(|port| port <= MAX_PORT)\n}\n\n/// Does this authority carry a label a URL parser decodes as Punycode?\n///\n/// A parser reads every label that starts with `xn--` as an internationalized\n/// name, and it fails the whole parse when the decode fails. `xn--a` passes\n/// `valid_authority` — it carries no character that reshapes a URL and no label\n/// that reads as a number — and `new URL(request.url)` still throws on it. A\n/// charset cannot see this, because Punycode is an encoding and not a charset,\n/// and the rules that decide a decoded label are the whole of IDNA. So the\n/// decision is reified here and the check itself belongs with a parser.\n///\n/// The predicate exists to keep that parser off the request path. A hostname\n/// carries no such label in almost every deployment, so celld scans for the\n/// prefix and parses only when it is present. Refusing every `xn--` label\n/// instead would cost every internationalized deployment its hostname, and\n/// admitting every one of them hands a client an error it can aim at any\n/// request.\nfn has_idn_label(authority: &str) -> bool {\n authority.split('.').any(|label| {\n label\n .as_bytes()\n .get(..4)\n .is_some_and(|prefix| prefix.eq_ignore_ascii_case(b\"xn--\"))\n })\n}\n\n/// The scheme celld serves for this value, or `None` for a value it cannot\n/// serve. Only `http` and `https`.\n///\n/// The scheme is interpolated into `request.url`, and a Worker builds a\n/// redirect or a link from it. An arbitrary scheme therefore becomes an\n/// arbitrary URL in an application's output: `X-Forwarded-Proto: javascript:`\n/// makes `new URL(request.url).protocol` read `javascript:`. celld speaks only\n/// HTTP, so no other scheme can be correct.\n///\n/// The header casing is not fixed, so the match ignores case. The return is the\n/// canonical spelling rather than the text that arrived, because celld puts the\n/// result in a URL it logs and hands on, and a scheme is lowercase there.\npub fn canonical_scheme(scheme: &str) -> Option<&'static str> {\n if scheme.eq_ignore_ascii_case(\"http\") {\n Some(\"http\")\n } else if scheme.eq_ignore_ascii_case(\"https\") {\n Some(\"https\")\n } else {\n None\n }\n}\n","editable",false,"branch","documentNavigation","repo","denoland/celld","repoId","a23b8a10-92cf-4dc4-a7ab-a04e58298dde","ownerId","org:42048915","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",1,"watchers","watching","pinned","notify","views",[134,135,136,137,138,139,140,141,142,143,144,145,146],"navigation",{"_55":56,"_91":92,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102},"sources",[],"viewer","meta",{"_83":84,"_85":86,"_87":88,"_43":32,"_89":14,"_90":32,"_49":50,"_51":50},"branches",[14],"tags",[70,71,72,73,74,75,76,77,78,79,80,81,82],"cloneUrl","https://git.nexthub.sh/denoland/celld.git","v0.0.1","v0.0.2","v0.1.0","v0.2.0","v0.2.1","v0.3.0","v0.4.0","v0.4.1","v0.5.0","v0.5.1","v0.6.0","v0.6.1","v0.6.2","description","self-hosted, distributed Durable Objects","owner","denoland","section","","head","empty","pins",[116,117,118],"documents",{"_111":112,"_113":114},"code",{"_108":109,"_110":104},"automations",{"_106":50,"_107":-5},"delivery",{"_103":104,"_105":-5},"tag","7gTA52Z9a1vO6FP6eCQPix9zO4O","releases",0,"applications","workflows","deployments","commits",13,"changes","counts",{"_115":114},"total",38,"issue",{"_119":110,"_121":132,"_15":110,"_123":133,"_53":125,"_126":32,"_127":125,"_128":104},{"_119":129,"_121":130,"_15":129,"_123":131,"_53":125,"_126":32,"_127":125,"_128":104},{"_119":120,"_121":122,"_15":120,"_123":124,"_53":125,"_126":32,"_127":125,"_128":114},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_119":110,"_121":132,"_15":110,"_123":177,"_53":125,"_126":32,"_127":125},{"_119":129,"_121":130,"_15":129,"_123":176,"_53":125,"_126":32,"_127":125},{"_119":120,"_121":122,"_15":120,"_123":175,"_53":125,"_126":32,"_127":125},{"_119":172,"_121":173,"_15":172,"_123":174,"_53":32,"_126":32,"_127":125},{"_119":169,"_121":170,"_15":169,"_123":171,"_53":32,"_126":32,"_127":125},{"_119":106,"_121":167,"_15":97,"_123":168,"_53":32,"_126":32,"_127":125},{"_119":107,"_121":164,"_15":165,"_123":166,"_53":32,"_126":32,"_127":125},{"_119":103,"_121":162,"_15":103,"_123":163,"_53":32,"_126":32,"_127":125},{"_119":158,"_121":159,"_15":160,"_123":161,"_53":32,"_126":32,"_127":125},{"_119":93,"_121":156,"_15":93,"_123":157,"_53":32,"_126":32,"_127":32},{"_119":153,"_121":154,"_15":153,"_123":155,"_53":32,"_126":32,"_127":32},{"_119":150,"_121":151,"_15":150,"_123":152,"_53":32,"_126":32,"_127":32},{"_119":147,"_121":148,"_15":147,"_123":149,"_53":32,"_126":32,"_127":32},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794435199447,"sidebar","expanded"]