IsAllowedCertificateURL reports whether rawURL points to a host on the allowlist, uses http or https, and targets a standard PKI distribution port. Microsoft and DigiCert serve these artifacts on 80/443 only; any other port is rejected to keep the SSRF surface as narrow as the hostname itself.
(rawURL string)
| 157 | // these artifacts on 80/443 only; any other port is rejected to |
| 158 | // keep the SSRF surface as narrow as the hostname itself. |
| 159 | func IsAllowedCertificateURL(rawURL string) bool { |
| 160 | if rawURL == "" { |
| 161 | return false |
| 162 | } |
| 163 | u, err := url.Parse(rawURL) |
| 164 | if err != nil { |
| 165 | return false |
| 166 | } |
| 167 | if u.Scheme != "http" && u.Scheme != "https" { |
| 168 | return false |
| 169 | } |
| 170 | if !allowedCertHosts[u.Hostname()] { |
| 171 | return false |
| 172 | } |
| 173 | switch u.Port() { |
| 174 | case "", "80", "443": |
| 175 | return true |
| 176 | default: |
| 177 | return false |
| 178 | } |
| 179 | } |
| 180 | |
| 181 | type metadata struct { |
| 182 | VMID string `json:"vmId"` |