[dezren39]

Fixes #505

Change

validate_crawl_url in pkgs/lab-ops-hub/container/app.py now refuses any host containing a raw %, right after the empty-host check:

• WHATWG URL parsing percent-decodes the host before judging it — %6cocalhost is localhost — and rejects the other % spellings outright, while urlparse handed them through verbatim and the validator mistook them for public DNS names.
• ipaddress accepts IPv6 zone ids ([2001:4860:4860::8888%25eth0]), which the Worker validator refuses; the blanket % rule closes that too.

Note on the controls from #505

%65xample.com / example%2ecom decode to public names and stay ALLOW on the TS side; this PR makes the container fail-closed stricter there (the container is the component that actually fetches, and no legitimate crawl target needs a percent-encoded host). That residual divergence is intentional and documented in the code comment.

Verification

• New test_refuses_percent_encoded_hosts_and_zone_ids in test/test_container_validate.py (9 spellings, incl. %6cocalhost, localhost%00, 127.0.0.1%09, malformed bare/truncated %, and the zone-id literal).
• Ablation: with only app.py reverted, the new test fails (1 failure / 10); with the fix, python3 -m unittest discover -s test passes 10/10 and npm test is green.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Bug Fixes

  • Improved URL validation to reject hosts containing percent-encoded characters, malformed escapes, and IPv6 zone identifiers.
  • Prevents potentially unsafe host formats from bypassing validation.

• Tests

  • Added coverage for encoded hostnames, control characters, malformed escapes, and IPv6 zone identifiers.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T21:05:18.669613Z	9941009	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 59abdb47-4a85-42cb-8672-82c829b26567

📥 Commits

Reviewing files that changed from the base of the PR and between eaf371c and 9941009.

📒 Files selected for processing: 2

• pkgs/lab-ops-hub/container/app.py
• pkgs/lab-ops-hub/test/test_container_validate.py

+--------------------------------------------------------------------------------+
| A bunny is never late, nor is he early, he reviews precisely when he means to. |
+--------------------------------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}