Won Park 3ae4225b17
Restrict cloud task credentials to trusted origins ( #41403 ) ...
## Why
Cloud task requests can use saved ChatGPT credentials, so their destination must be constrained before authentication is loaded or any request is made.
## What changed
- Validate `CODEX_CLOUD_TASKS_BASE_URL` against trusted ChatGPT HTTPS origins on port 443 and reject URLs containing user information, queries, or fragments.
- Disable redirects for cloud task backend and environment-discovery clients so credentials are never forwarded to a redirect destination.
- Normalize the validated base URL before configuring authentication and HTTP clients.
## Testing
Add a CLI integration test that verifies a custom cloud backend is rejected without receiving a request, while the staging origin continues to use explicit token authentication.
GitOrigin-RevId: f0dddf363b4e44ea3530f81d9a817e978c15ead2
2026-08-28 19:44:50 +00:00
2026-07-29 13:53:15 +00:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-24 22:40:35 +00:00
2026-08-27 02:19:10 +00:00
2026-07-29 13:53:15 +00:00
2026-08-28 19:12:34 +00:00
2026-08-18 23:05:52 +00:00
2026-07-21 08:50:21 +00:00
2026-08-28 18:07:40 +00:00
2026-07-30 19:47:30 +00:00
2026-08-25 03:08:33 +00:00
2026-08-24 21:39:48 +00:00
2026-08-20 08:10:08 +00:00
2026-08-25 07:37:42 +00:00
2026-08-24 21:39:48 +00:00
2026-08-28 19:44:50 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-28 19:44:50 +00:00
2026-08-25 16:38:46 +00:00
2026-08-28 19:44:50 +00:00
2026-08-28 19:44:50 +00:00
2026-08-27 01:55:53 +00:00
2026-08-27 01:55:53 +00:00
2026-08-27 01:55:53 +00:00
2026-08-21 16:50:34 +00:00
2026-08-27 21:03:09 +00:00
2026-08-18 23:47:00 +00:00
2026-08-13 23:13:37 +00:00
2026-08-25 21:20:51 +00:00
2026-08-28 14:53:53 +00:00
2026-08-04 22:58:02 +00:00
2026-08-28 02:09:07 +00:00
2026-08-07 00:23:38 +00:00
2026-08-23 18:53:15 +00:00
2026-08-28 19:29:51 +00:00
2026-08-25 21:20:51 +00:00
2026-08-28 19:12:34 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-28 01:14:02 +00:00
2026-08-27 23:24:21 +00:00
2026-08-27 21:05:40 +00:00
2026-08-17 04:37:50 +00:00
2026-08-28 18:23:47 +00:00
2026-08-26 15:02:21 +00:00
2026-08-28 17:33:10 +00:00
2026-08-18 21:46:18 +00:00
2026-07-31 21:37:56 +00:00
2026-08-27 20:44:47 +00:00
2026-08-25 21:34:05 +00:00
2026-08-28 19:02:26 +00:00
2026-08-25 01:03:20 +00:00
2026-08-25 10:29:26 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-08-26 23:41:18 +00:00
2026-07-22 04:17:34 +00:00
2026-08-25 21:08:22 +00:00
2026-08-28 01:14:02 +00:00
2026-08-28 15:10:58 +00:00
2026-07-17 20:52:42 +00:00
2026-08-28 01:14:02 +00:00
2026-08-26 14:36:48 +00:00
2026-08-27 21:03:09 +00:00
2026-08-25 18:41:03 +00:00
2026-07-30 04:26:36 +00:00
2026-08-25 22:46:49 +00:00
2026-08-21 21:01:59 +00:00
2026-08-25 15:50:19 +00:00
2026-08-28 18:07:40 +00:00
2026-08-26 17:45:42 +00:00
2026-08-21 16:45:05 +00:00
2026-08-28 19:29:51 +00:00
2026-08-28 16:04:26 +00:00
2026-08-28 01:14:02 +00:00
2026-08-26 23:49:05 +00:00
2026-08-10 15:43:10 +00:00
2026-08-27 23:58:09 +00:00
2026-08-08 16:58:26 +00:00
2026-08-20 06:10:03 +00:00
2026-08-27 23:43:46 +00:00
2026-08-04 03:49:53 +00:00
2026-08-28 02:09:07 +00:00
2026-08-28 16:04:26 +00:00
2026-08-27 02:00:31 +00:00
2026-08-28 18:07:40 +00:00
2026-08-27 21:15:37 +00:00
2026-07-22 16:18:08 +00:00
2026-08-20 14:55:08 +00:00
2026-08-27 21:15:37 +00:00
2026-08-15 14:31:04 +00:00
2026-08-25 21:44:43 +00:00
2026-07-09 17:31:44 -07:00
2026-08-28 19:02:26 +00:00
2026-08-28 19:02:26 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 22:00:25 +00:00
Won Park
3ae4225b17