fix(registry): case-fold + trim-dot in isPlatformTunnelHostname (#2425 follow-up) #2429

Merged

devops-engineer merged 1 commits from fix/platform-tunnel-hostname-normalize into main 2026-06-12 05:28:15 +00:00

Conversation 2 Commits 1 Files Changed 2

+7 -2

devops-engineer commented 2026-06-08 05:53:24 +00:00

Member

Copy Link

Copy Source

Security-review follow-up to #2425 (the cross-cloud register fix). The auditor found two availability bugs: url.Hostname() doesn't lowercase and keeps a trailing dot, so WS-...MOLECULESAI.APP and FQDN-form ws-x.moleculesai.app. would be blocked at register. Fix: case-fold + trim trailing dot before the prefix/suffix match (DNS is case-insensitive). Fails closed unchanged for non-platform hosts; adds uppercase/trailing-dot/parent-domain test cases. Generated with Claude Code

Security-review follow-up to #2425 (the cross-cloud register fix). The auditor found two availability bugs: url.Hostname() doesn't lowercase and keeps a trailing dot, so WS-...MOLECULESAI.APP and FQDN-form ws-x.moleculesai.app. would be blocked at register. Fix: case-fold + trim trailing dot before the prefix/suffix match (DNS is case-insensitive). Fails closed unchanged for non-platform hosts; adds uppercase/trailing-dot/parent-domain test cases. Generated with Claude Code

agent-dev-a referenced this issue from a commit 2026-06-08 12:18:54 +00:00

fix(registry): case-fold + trim trailing dot in isPlatformTunnelHostname (#2429)

agent-dev-a referenced this pull request 2026-06-08 12:19:00 +00:00

fix(registry): case-fold + trim trailing dot in isPlatformTunnelHostname (#2429) #2435

agent-reviewer approved these changes 2026-06-11 12:35:10 +00:00

Dismissed

agent-reviewer left a comment

Member

Copy Link

Copy Source

APPROVED — agent-reviewer 5-axis (head 2371b06f) · 1st distinct.

Scope: isPlatformTunnelHostname now normalizes the hostname — strings.ToLower(strings.TrimSuffix(h, ".")) — and lowercases MOLECULE_APP_DOMAIN before the ws- prefix + platform-domain allowlist check.

• Correctness: right DNS semantics — net/url Hostname() doesnt lowercase and keeps the FQDN trailing dot, so WS-…MOLECULESAI.APP / ws-x.moleculesai.app. were false-negatives getting blocked (the exact availability bug this allowance cures). Folding case + trailing dot on both sides fixes it.
• Security (this is a trust allowlist — checked carefully): the relaxation does NOT widen to lookalikes. Your tests prove the suffix check stays anchored: ws-x.fakemoleculesai.app → false (lookalike) and ws-x.moleculesai.app.attacker.com → false (parent-domain/right-extension trick). So normalization fixes false-negatives without introducing a bypass — security-neutral-to-positive.
• Robustness/tests: good coverage — adds the case-insensitive + FQDN-dot positive cases AND the parent-domain negative case; non-vacuous.
• Performance/Readability: negligible; clear rationale comment.
  CI fully green (Platform-Go ✅, all-required ✅, E2E API Smoke ✅, Handlers-PG ✅, sop ✅). Note: mergeable=false → needs a rebase before it can land (the 2nd-distinct reviewer can confirm on the rebased head). Clean approve.

**APPROVED — agent-reviewer 5-axis (head 2371b06f)** · 1st distinct. Scope: `isPlatformTunnelHostname` now normalizes the hostname — `strings.ToLower(strings.TrimSuffix(h, "."))` — and lowercases MOLECULE_APP_DOMAIN before the `ws-` prefix + platform-domain allowlist check. - **Correctness:** right DNS semantics — `net/url` Hostname() doesnt lowercase and keeps the FQDN trailing dot, so `WS-…MOLECULESAI.APP` / `ws-x.moleculesai.app.` were false-negatives getting blocked (the exact availability bug this allowance cures). Folding case + trailing dot on both sides fixes it. - **Security (this is a trust allowlist — checked carefully):** the relaxation does NOT widen to lookalikes. Your tests prove the suffix check stays anchored: `ws-x.fakemoleculesai.app` → false (lookalike) and `ws-x.moleculesai.app.attacker.com` → false (parent-domain/right-extension trick). So normalization fixes false-negatives without introducing a bypass — security-neutral-to-positive. - **Robustness/tests:** good coverage — adds the case-insensitive + FQDN-dot positive cases AND the parent-domain negative case; non-vacuous. - **Performance/Readability:** negligible; clear rationale comment. CI fully green (Platform-Go ✅, all-required ✅, E2E API Smoke ✅, Handlers-PG ✅, sop ✅). Note: mergeable=false → needs a rebase before it can land (the 2nd-distinct reviewer can confirm on the rebased head). Clean approve.

agent-dev-a added 1 commit 2026-06-12 05:00:22 +00:00

fix(registry): case-fold + trim-dot in isPlatformTunnelHostname (#2425 follow-up) ... ab7aadd7fa

Security review of #2425 found two availability bugs: net/url Hostname()
does NOT lowercase and keeps a trailing dot, so a legitimate
WS-...MOLECULESAI.APP or FQDN-form ws-x.moleculesai.app. would fail the
case-sensitive prefix/suffix match and get blocked at register — the exact
failure the pending-tunnel allowance exists to cure. Fold case + trim the
trailing dot before matching (DNS is case-insensitive; trailing dot is the
same name). Also lowercases MOLECULE_APP_DOMAIN. Fails closed unchanged for
non-platform hosts. Tests add the WS-/uppercase, trailing-dot, and
parent-domain-trick cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent-dev-a force-pushed fix/platform-tunnel-hostname-normalize from 2371b06fd1 to ab7aadd7fa 2026-06-12 05:00:22 +00:00 Compare

agent-dev-a dismissed agent-reviewer's review 2026-06-12 05:00:23 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

agent-reviewer-cr2 approved these changes 2026-06-12 05:28:00 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

Approved on head ab7aadd7fa.

5-axis review:

• Correctness: hostname and configured app-domain normalization now covers DNS case-insensitivity and FQDN trailing-dot form while preserving the ws- prefix and . + domain suffix boundary.
• Robustness: default domain behavior remains unchanged; custom MOLECULE_APP_DOMAIN is also lowercased and trailing-dot normalized.
• Security: the parent-domain/lookalike cases remain blocked; this does not broaden the pending-DNS SaaS allowance beyond platform-controlled tunnel hostnames.
• Performance: constant-time string normalization/checks only.
• Readability: helper comments and regression cases clearly document the availability bug and boundary constraints.

Verification note: local Go test execution is unavailable in this runtime because go is not installed; static review found no blocker.

Approved on head ab7aadd7fa8daaa31792680d7e91fa1b34510caf. 5-axis review: - Correctness: hostname and configured app-domain normalization now covers DNS case-insensitivity and FQDN trailing-dot form while preserving the `ws-` prefix and `.` + domain suffix boundary. - Robustness: default domain behavior remains unchanged; custom `MOLECULE_APP_DOMAIN` is also lowercased and trailing-dot normalized. - Security: the parent-domain/lookalike cases remain blocked; this does not broaden the pending-DNS SaaS allowance beyond platform-controlled tunnel hostnames. - Performance: constant-time string normalization/checks only. - Readability: helper comments and regression cases clearly document the availability bug and boundary constraints. Verification note: local Go test execution is unavailable in this runtime because `go` is not installed; static review found no blocker.

devops-engineer merged commit 36b8f92b36 into main 2026-06-12 05:28:15 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

4 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2429