fix(security): reject raw paths that change the authenticated API origin (#32)

[karlwaldman]

Closes #32.

Confirmed live on main 3b24c6d — and worse than the issue text

The issue predicted @fixture.invalid/v1/prices resolves off-origin. It does, and so do five other forms. The SDK attaches Authorization: Token <key> in setHeaders unconditionally, and doRequestWithHeaders built the URL as c.baseURL + endpoint with no check — so any path not starting with / appends to the base host, not to its path, and the customer's key goes with it.

Probed with a capturing http.RoundTripper and the placeholder key FIXTURE-KEY-NOT-A-REAL-CREDENTIAL. No network request and no real credential was used.

Where Go differs from the Python fix (python-sdk#113)

Do not assume the Python findings port. They do not:

Python finding	Go behaviour on main
//fixture.invalid/v1/prices resolves to a foreign host	Does not reproduce. Go concatenates rather than urljoins, so //host is only a double-slash path on api.oilpriceapi.com.
//user@fixture.invalid/... swaps Token for Basic dXNlcjo=	Does not reproduce. Stays same-origin, and setHeaders runs after http.NewRequest, so it would overwrite any userinfo-derived Basic header anyway.
—	New in Go: the host-suffix form .evil.invalid/v1/prices produces api.oilpriceapi.com.evil.invalid, a fully attacker-controlled domain. Python's urljoin never had this shape.

Bypass-probe results — full set, before and after

18 adversarial forms plus 6 legitimate paths. host is what the transport actually saw; auth is the header that rode along.

#	probe path	before (host)	auth attached	after
1	//fixture.invalid/v1/prices	api.oilpriceapi.com	yes	rejected
2	@fixture.invalid/v1/prices	fixture.invalid	yes	rejected
3	:8080@fixture.invalid/v1/prices	fixture.invalid	yes	rejected
4	@fixture.invalid:443/v1/prices	fixture.invalid:443	yes	rejected
5	@[::1]:9/v1/prices	[::1]:9	yes	rejected
6	//user@fixture.invalid/v1/prices	api.oilpriceapi.com	yes	rejected
7	.evil.invalid/v1/prices	api.oilpriceapi.com.evil.invalid	yes	rejected
8	v1/prices	api.oilpriceapi.comv1	yes	rejected
9	\\fixture.invalid/v1/prices	none — *url.Error	no	rejected, *InvalidPathError
10	\\@fixture.invalid/v1/prices	none — *url.Error	no	rejected, *InvalidPathError
11	%2F%2Ffixture.invalid/v1/prices	none — *url.Error	no	rejected, *InvalidPathError
12	HTTP://fixture.invalid/v1/prices	api.oilpriceapi.comHTTP	yes	rejected
13	http://fixture.invalid/v1/prices	api.oilpriceapi.comhttp	yes	rejected
14	http://api.oilpriceapi.com/v1/prices	api.oilpriceapi.comhttp	yes	rejected
15	//fixture.invalid/v1/prices	none — *url.Error	no	rejected, *InvalidPathError
16	/..//fixture.invalid/v1/prices	api.oilpriceapi.com	yes	rejected
17	/../../v1/prices	api.oilpriceapi.com	yes	rejected
18	`` (empty)	api.oilpriceapi.com	yes	rejected
L1	/v1/prices/latest	api.oilpriceapi.com	yes	unchanged, allowed
L2	/v1/prices/latest?by_code=BRENT_CRUDE_USD	api.oilpriceapi.com	yes	unchanged, allowed
L3	/v1/pri%20ces/latest	api.oilpriceapi.com	yes	unchanged, allowed, escaping preserved
L4	/v1/prices/BRENT%2FWTI	api.oilpriceapi.com	yes	unchanged, allowed, %2F not decoded to /
L5	/@fixture.invalid/v1/prices	api.oilpriceapi.com	yes	unchanged, allowed (an @ inside a path is fine)
L6	/v1/well-production/wells/42/monthly	api.oilpriceapi.com	yes	unchanged, allowed

Six forms reached a foreign or attacker-suffixed host with a live Authorization: Token header. Three were already rejected, but by net/url with an untyped *url.Error that callers cannot distinguish from a transport failure; they now return *InvalidPathError. Nine more stayed same-origin but are refused at the boundary rather than relied on — Go's parser quirks are not a security contract.

The fix

resolveEndpoint in client.go, called at the top of doRequestWithHeaders before the request is built and before any credential is attached:

1. Reject whitespace and control characters.
2. Take the portion before the first ? or # — an authority can only appear there.
3. Require a single leading /; reject //, any backslash, and any .. segment.
4. Parse the base URL (trailing slashes trimmed), join, re-parse, and assert the resolved (scheme, host, port) equals the base origin, folding default ports.

Step 4 cannot fail given steps 1–3. It is deliberately kept as the assertion that survives a future refactor of the joining, which is exactly how this bug arose.

The gate is in doRequestWithHeaders, not in Raw. Raw is not the only entry point: DeleteWebhook, the alerts methods and the webhooks methods interpolate a caller-supplied id straight into a path ("/v1/alerts/" + id) with no escaping. Those now go through the same check — verified in TestTypedEndpointsRejectOffOriginIDs.

Explicit custom base URLs (proxies, test servers, on-prem) still define the allowed origin and keep working, including with a trailing slash.

Red / green

Red, with client.go reverted to origin/main and the new test file in place:

$ git checkout origin/main -- client.go && go test -run TestRawRejectsOffOriginPaths -v .
    raw_origin_test.go:74: off-origin request: path "@fixture.invalid/v1/prices" reached host "fixture.invalid" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path ":8080@fixture.invalid/v1/prices" reached host "fixture.invalid" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path "@fixture.invalid:443/v1/prices" reached host "fixture.invalid:443" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path "@[::1]:9/v1/prices" reached host "[::1]:9" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path ".evil.invalid/v1/prices" reached host "api.oilpriceapi.com.evil.invalid" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path "v1/prices" reached host "api.oilpriceapi.comv1" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:88: path "\\\\fixture.invalid/v1/prices" rejected with *url.Error (...), want *InvalidPathError
    raw_origin_test.go:88: path "\\\\@fixture.invalid/v1/prices" rejected with *url.Error (...), want *InvalidPathError
    raw_origin_test.go:88: path "%2F%2Ffixture.invalid/v1/prices" rejected with *url.Error (...), want *InvalidPathError
    raw_origin_test.go:74: off-origin request: path "HTTP://fixture.invalid/v1/prices" reached host "api.oilpriceapi.comHTTP" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path "http://fixture.invalid/v1/prices" reached host "api.oilpriceapi.comhttp" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:74: off-origin request: path "http://api.oilpriceapi.com/v1/prices" reached host "api.oilpriceapi.comhttp" carrying "Token FIXTURE-KEY-NOT-A-REAL-CREDENTIAL"
    raw_origin_test.go:88: path "  //fixture.invalid/v1/prices" rejected with *url.Error (...), want *InvalidPathError
--- FAIL: TestRawRejectsOffOriginPaths (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/userinfo-embedded (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/userinfo-with-port (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/userinfo-host-port (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/userinfo-ipv6 (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/host-suffix (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/no-leading-slash (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/backslash-authority (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/backslash-userinfo (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/percent-encoded-slashes (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/uppercase-scheme (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/absolute-url (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/scheme-downgrade-own-host (0.00s)
    --- FAIL: TestRawRejectsOffOriginPaths/whitespace-padded (0.00s)
FAIL	github.com/OilpriceAPI/oilpriceapi-go	0.010s

Green, with the fix restored:

$ go test -run 'TestRawRejectsOffOriginPaths|TestRawAllowsLegitimatePaths|TestCustomBaseURLStillWorks|TestTypedEndpointsRejectOffOriginIDs' -v .
--- PASS: TestRawRejectsOffOriginPaths (0.00s)        [18/18 subtests PASS]
--- PASS: TestRawAllowsLegitimatePaths (0.00s)        [6/6 subtests PASS]
--- PASS: TestCustomBaseURLStillWorks (0.00s)
--- PASS: TestTypedEndpointsRejectOffOriginIDs (0.00s)
    raw_origin_test.go:181: DeleteWebhook rejected: invalid API path "/v1/webhooks/../../../@fixture.invalid/x": path contains a ".." segment (paths must be origin-relative and start with a single "/")
ok  	github.com/OilpriceAPI/oilpriceapi-go	0.011s

Note TestCustomBaseURLStillWorks drops from 7.03s to 0.00s — pre-fix, its off-origin probe performed a real DNS lookup for fixture.invalid.

Full suite

	baseline origin/main	this branch
go test ./...	ok ... 1.314s	ok ... 1.318s
passing tests	237	265 (+28)
failing tests	0	0

go vet ./... clean, gofmt -l . clean. Go 1.26.5 darwin/arm64.

Reviewer notes

• This is behaviour-breaking for a caller who relied on a path without a leading /. Nothing in the SDK does, and Raw's doc comment has always required /, but it is a minor-version change, not a patch.
• The ..-segment rejection is stricter than strictly needed for origin safety (/../../v1/prices stays same-origin on main). It is included because an intermediary that normalises /..//host/x to //host/x re-creates the authority form, and no legitimate OilPriceAPI path contains ... Say the word if you want that relaxed.
• No CHANGELOG entry: release_contract_test.go requires the top changelog heading to equal Version, so the entry has to land with the version bump at release time.
• Not merged, no auto-merge, no release tagged.

🤖 Generated with Claude Code

https://claude.ai/code/session_015ao5paex73xXvuM424Libo

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d4066192-aff8-4ee2-af0b-24dbcc3651dc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}