fix: validate host headers and handle malformed editor URLs

[bjohansebas]

Summary

Host and HTTP/2 authority headers currently share protocol exceptions intended for Origin, and malformed values can make open-editor URL parsing throw. Restrict those exceptions to Origin, validate Host syntax, and parse open-editor URLs with a fixed base, returning 400 for malformed URLs.

What kind of change does this PR introduce?

Fix.

Did you add tests for your changes?

Yes. Added regression coverage for malformed Host and authority headers, existing Origin behavior, and open-editor URL handling with allowedHosts set to "auto", an explicit list, or "all".

• 187 regression, API, and proxy WebSocket tests passed.
• Full lint, type generation, CommonJS build, and changeset validation passed.

Does this PR introduce a breaking change?

No. The existing isValidHost(headers, headerToCheck, validateHost) signature and calls are preserved. Malformed Host and authority headers are now rejected, including with allowedHosts: "all".

If relevant, what needs to be documented once your changes are merged or what have you already documented?

Included a patch changeset describing Host and authority header validation and controlled handling of malformed open-editor URLs.

Use of AI

Yes. Codex assisted with the implementation, regression tests, debugging, and this PR description. The tests, lint, builds, and changeset validation listed above were executed locally.

[changeset-bot]

🦋 Changeset detected

Latest commit: 586fdb0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
webpack-dev-server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5cf01689-a167-4c97-a0bf-f0974d059279

📥 Commits

Reviewing files that changed from the base of the PR and between b4eb797 and 586fdb0.

📒 Files selected for processing: 4

• .changeset/tidy-host-headers.md
• lib/Server.js
• test/ports-map.js
• test/server/host-header-validation.test.js

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Host and :authority validation now rejects malformed values. Permitted-protocol acceptance and early acceptance for allowedHosts: "all" apply only to Origin checks. Parsed Host names can still pass with allowedHosts: "all" or an allowed hostname. The open-editor endpoint parses request URLs against a fixed localhost base and returns 400 Invalid URL when parsing fails. Tests cover validation behavior and open-editor requests. A patch changeset and test port mapping were added.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 586fd

The changed request-validation paths have no identified issue that needs resolution before merge.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes: host header validation and malformed editor URL handling.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.36%. Comparing base (b4eb797) to head (586fdb0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5771      +/-   ##
==========================================
+ Coverage   95.15%   95.36%   +0.21%     
==========================================
  Files           6        6              
  Lines        5016     5029      +13     
==========================================
+ Hits         4773     4796      +23     
+ Misses        243      233      -10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.