[dezren39]

Fixes #507

The container crawler's validate_crawl_url classified two host forms as "a public DNS name" that the Worker's validateCrawlUrl refuses outright:

• Space/control hosts (http://exam ple.com/): urlparse hands the host through verbatim and the old code returned it as a DNS name; the fetcher then died deep inside http.client with InvalidURL: URL can't contain control characters — the same lazy-failure shape lab-ops-hub: container crawler treats invalid IPv4 spellings, numeric-final-label hosts and malformed ports as public DNS names #502 fixed for ports. The validator now refuses any host containing a character with ord <= 0x20, up front.
• Bracketed non-IPv6 literals (http://[v1.fe80::]/, http://[v7.a]/): these occupied the IP-literal position but are not valid IPv6 literals (IPvFuture forms). urlparse strips the brackets, so the check inspects the netloc in the DNS-name fall-through and fails closed instead of reclassifying the host as a public DNS name.

Verified:

• npm test in pkgs/lab-ops-hub: TS suite + Python suite 11/11 (1 new regression test covering both classes).
• Ablation: with only container/app.py reverted, the new test fails; restored, all green.
• Controls unchanged: exam_ple.com, ordinary DNS names, valid IPv6 literals and public targets still accepted (existing suite).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Bug Fixes

  • Crawl URL validation now rejects hosts containing spaces or control characters.
  • Invalid bracketed host literals are no longer treated as public DNS names.

• Tests

  • Added coverage for unsafe host characters and invalid bracketed address literals.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T21:26:13.042032Z	ebbeb8b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 362684b1-7c48-40d4-9ba1-a6384888180c

📥 Commits

Reviewing files that changed from the base of the PR and between 1f2ae9f and ebbeb8b.

📒 Files selected for processing: 2

• pkgs/lab-ops-hub/container/app.py
• pkgs/lab-ops-hub/test/test_container_validate.py

+-------------------------------------------------------------------+
| Find some code, review it up, all day long you'll have good luck! |
+-------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ebbeb8bca0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject DEL alongside the other control characters

For a target such as http://exam\x7fple.com/, urlparse preserves DEL in the hostname, but this predicate accepts it because U+007F is above U+0020. The Worker’s WHATWG parser rejects the URL, while the container proceeds until http.client raises InvalidURL, recreating the deep-fetch failure this change is intended to prevent. Include DEL (and preferably the full relevant control-character range) in the upfront rejection.

Useful? React with 👍 / 👎.