mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
801ca0d0d1
## What changed - Add `RemoteEnvironmentOptions` and `upsert_environment_with_options` so embedding hosts can attach trusted HTTP headers to remote exec-server WebSocket handshakes. - Preserve the headers across session reconnects while redacting them from debug output. - Reject invalid, duplicate, and WebSocket-controlled headers, and require `wss://` for non-loopback destinations. - Connect header-bearing loopback WebSockets directly, with DNS results restricted to loopback addresses. ## Testing - Cover header validation and redaction, delivery on initial connections and reconnects, and loopback destination enforcement. GitOrigin-RevId: f2e2b0456c8e33c13fd8ab4ee040a8b5c15e885d
35 lines
862 B
Rust
35 lines
862 B
Rust
use tokio_tungstenite::tungstenite::http::Uri;
|
|
|
|
use super::is_loopback_destination;
|
|
|
|
#[test]
|
|
fn recognizes_loopback_websocket_destinations() {
|
|
for destination in [
|
|
"ws://localhost:8080",
|
|
"ws://LOCALHOST:8080",
|
|
"ws://127.0.0.1:8080",
|
|
"ws://[::1]:8080",
|
|
] {
|
|
let uri = destination.parse::<Uri>().unwrap();
|
|
assert!(
|
|
is_loopback_destination(&uri),
|
|
"expected loopback destination: {destination}; parsed host: {:?}",
|
|
uri.host()
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_non_loopback_websocket_destinations() {
|
|
for destination in [
|
|
"ws://relay.example:8080",
|
|
"ws://192.0.2.1:8080",
|
|
"ws://[2001:db8::1]:8080",
|
|
"/missing-host",
|
|
] {
|
|
assert!(!is_loopback_destination(
|
|
&destination.parse::<Uri>().unwrap()
|
|
));
|
|
}
|
|
}
|