From 97da8b63a9bf0da67e7a3e13e0556d5bbb169dfb Mon Sep 17 00:00:00 2001 From: Chris Duncan Date: Sun, 9 Aug 2026 20:39:11 -0700 Subject: [PATCH] Upgrade HTTP but otherwise reject non-HTTPS RPC URLs. --- src/lib/rpc/index.ts | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/src/lib/rpc/index.ts b/src/lib/rpc/index.ts index 1b5cb46..9834700 100644 --- a/src/lib/rpc/index.ts +++ b/src/lib/rpc/index.ts @@ -34,12 +34,21 @@ export class Rpc { */ constructor (url: string | URL, auth?: { header: string, value: string }) constructor (url: unknown, auth: unknown) { - if ((typeof url === 'string' || url instanceof URL) && URL.canParse(url)) { - this.#url = new URL(url) - this.#url.protocol = 'https:' - } else { - throw new RpcError('Invalid URL', { cause: url }) + if (typeof url !== 'string' && !(url instanceof URL)) { + throw new RpcError('Invalid RPC URL', { cause: url }) } + if (!(URL.canParse(url))) { + throw new RpcError('Failed to parse RPC URL', { cause: url }) + } + + const u = new URL(url) + if (u.protocol === 'http:') { + u.protocol = 'https:' + } + if (u.protocol !== 'https:') { + throw new RpcError('RPC requires HTTPS') + } + this.#url = u if (typeof auth === 'string') { (auth as string) = auth.trim() -- 2.52.0