willwang-openai 61a991990f Reject backslashes in HTTP(S) marketplace URL userinfo (#56263) ...

## Why

The URL parser treats backslashes as HTTP(S) path separators, while Git/libcurl does not. This difference can make a marketplace URL appear to match an allowed host pattern while Git connects to a different host.

## What changed

Reject HTTP(S) URLs containing literal backslashes in userinfo when checking marketplace host patterns. Continue allowing encoded backslashes in userinfo and backslashes in paths or query strings.

## Testing

Expand regression coverage to verify that denied URLs never invoke the cloner, create the marketplace install directory, or write configuration. Extend host-pattern tests to cover accepted HTTP(S) URL variants.

GitOrigin-RevId: cfdd29d6e83fb1718b505abaae85d37257317953

2026-10-22 20:55:25 +00:00

..

src

Reject backslashes in HTTP(S) marketplace URL userinfo (#56263)

2026-10-22 20:55:25 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Bound remote installed-plugin inventory pagination (#55946)

2026-10-21 17:28:24 +00:00