Skip to content

fix(server): Add boundary check for editing host name#1018

Merged
GT-610 merged 3 commits intolollipopkit:mainfrom
GT-610:fix/host-char
Jan 22, 2026
Merged

fix(server): Add boundary check for editing host name#1018
GT-610 merged 3 commits intolollipopkit:mainfrom
GT-610:fix/host-char

Conversation

@GT-610
Copy link
Collaborator

@GT-610 GT-610 commented Jan 22, 2026

Resolve #1016.

Summary by CodeRabbit

  • New Features
    • Host format validation now blocks saving invalid hosts and shows localized error messages (English, Ukrainian, Chinese Simplified, Chinese Traditional).
  • Chores
    • macOS plugin registration updated, removing the previously registered path provider plugin.

✏️ Tip: You can customize this high-level summary in your review settings.

Add validation for host formats, allowing only IPv4, IPv6, and domain name formats Add regular expression validation for host format on the server editing page Update multilingual files to add the invalidHostFormat field
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 22, 2026

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

The PR adds host-format validation to the server edit flow via a new regex check and prevents saving invalid host values; localized error messages were added in four ARB files. Additionally, PathProviderPlugin registration/import was removed from the macOS GeneratedPluginRegistrant.

Changes

Cohort / File(s) Summary
Localization Files
lib/l10n/app_en.arb, lib/l10n/app_uk.arb, lib/l10n/app_zh.arb, lib/l10n/app_zh_tw.arb
Added invalidHostFormat key with localized messages for host-format validation.
Host Validation Logic
lib/view/page/server/edit/actions.dart
Added private _hostReg RegExp to validate host input (IPv4/IPv6/domain chars incl. IPv6 zone ids) and applied pre-save validation in _onSave to show the new error message and abort save on mismatch.
macOS Platform Registration
macos/Flutter/GeneratedPluginRegistrant.swift
Removed PathProviderPlugin import and its registration call (auto-generated file).

Sequence Diagram(s)

mermaid
sequenceDiagram
participant User as User
participant UI as EditPage (form)
participant Validator as HostValidator
participant Storage as SaveHandler
participant L10n as Localization

User->>UI: Enter host and tap Save UI->>Validator: Validate host with `_hostReg` alt host invalid Validator-->>UI: invalid result UI->>L10n: request `invalidHostFormat` message L10n-->>UI: localized error string UI-->>User: show error (abort save) else host valid Validator-->>UI: valid result UI->>Storage: proceed to save Storage-->>UI: save result UI-->>User: show success or error 

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The removal of PathProviderPlugin from GeneratedPluginRegistrant.swift is unrelated to the host validation issue and appears to be an out-of-scope change. Remove the unrelated PathProviderPlugin removal from this PR or clarify its necessity in the context of fixing host input validation.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: adding input validation (boundary/regex check) for the host name field to prevent crashes from special characters.
Linked Issues check ✅ Passed The PR directly addresses issue #1016 by implementing regex validation for the host field to prevent crashes from special characters, matching the requested requirement.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

🧹 Recent nitpick comments
lib/view/page/server/edit/actions.dart (1)

3-4: Semicolon in regex appears unintended.

The character ; in the regex is not a valid character for IPv4 addresses, IPv6 addresses (including zone identifiers), or domain names. This seems like a typo—consider removing it to avoid accepting invalid input.

Suggested fix
-/// Only permit ipv4 / ipv6 / domain chars (including IPv6 zone identifier like %en0) -final _hostReg = RegExp(r'^[a-zA-Z0-9\.\-_:%;]+$'); +/// Only permit ipv4 / ipv6 / domain chars (including IPv6 zone identifier like %en0) +final _hostReg = RegExp(r'^[a-zA-Z0-9\.\-_:%]+$');
📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3a054e7 and 37c64a0.

📒 Files selected for processing (1)
  • lib/view/page/server/edit/actions.dart
🧰 Additional context used
📓 Path-based instructions (1)
lib/view/**/*.dart

📄 CodeRabbit inference engine (CLAUDE.md)

lib/view/**/*.dart: Prefer widgets/utilities from fl_lib for common UI (e.g., CustomAppBar, context.showRoundDialog, Input, Btnx.cancelOk)
Prefer using libL10n strings before adding new ones to project l10n
Split UI into build, actions, and utils; use extension on to separate concerns

Files:

  • lib/view/page/server/edit/actions.dart
🔇 Additional comments (1)
lib/view/page/server/edit/actions.dart (1)

228-231: LGTM!

The validation logic correctly checks the host format before proceeding with save. Error feedback via showSnackBar is consistent with other validation patterns in this function, and the early return prevents invalid data from being persisted.

✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot]
coderabbitai bot previously approved these changes Jan 22, 2026
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3a054e7241

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…Pv6 zone identifiers Modify the regular expression for hostname validation to add support for IPv6 zone identifiers (such as %en0)
@GT-610 GT-610 merged commit f47d1e7 into lollipopkit:main Jan 22, 2026
2 checks passed
@GT-610 GT-610 deleted the fix/host-char branch January 22, 2026 04:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant