From 49506b59a93f790cad24320091445f8e7dbd213f Mon Sep 17 00:00:00 2001 From: Nathan Thillairajah Date: Wed, 14 Oct 2026 11:48:54 -0400 Subject: [PATCH 1/2] Accept canonical Public Compose control-plane hosts --- src/bl/apps.rs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/bl/apps.rs b/src/bl/apps.rs index 3432d59..f52a232 100644 --- a/src/bl/apps.rs +++ b/src/bl/apps.rs @@ -63,6 +63,8 @@ const TRUSTED_CONTROL_PLANE_HOSTS: &[&str] = &[ "compose-ctrl.block.builderlab.xyz", "compose-ctrl.apps.builderlab.xyz", "compose-ctrl.apps.builderlabstaging.xyz", + "compose-ctrl.public.builderlab.xyz", + "compose-ctrl.public.builderlabstaging.xyz", ]; pub fn command() -> Command { @@ -4894,6 +4896,10 @@ mod tests { "https://compose-ctrl.apps.builderlab.xyz:443", "https://compose-ctrl.apps.builderlabstaging.xyz", "https://compose-ctrl.apps.builderlabstaging.xyz:443", + "https://compose-ctrl.public.builderlab.xyz", + "https://compose-ctrl.public.builderlab.xyz:443", + "https://compose-ctrl.public.builderlabstaging.xyz", + "https://compose-ctrl.public.builderlabstaging.xyz:443", "https://compose-ctrl.test.blockstaging.build:443", ] { assert!( @@ -4923,6 +4929,14 @@ mod tests { "https://compose-ctrl.apps.builderlabstaging.xyz.attacker.example", "https://compose-ctrl.apps.builderlabstaging.xyz:444", "https://user@compose-ctrl.apps.builderlabstaging.xyz", + "http://compose-ctrl.public.builderlab.xyz", + "https://user@compose-ctrl.public.builderlab.xyz", + "https://compose-ctrl.public.builderlab.xyz.attacker.example", + "https://compose-ctrl.public.builderlab.xyz:444", + "http://compose-ctrl.public.builderlabstaging.xyz", + "https://user@compose-ctrl.public.builderlabstaging.xyz", + "https://compose-ctrl.public.builderlabstaging.xyz.attacker.example", + "https://compose-ctrl.public.builderlabstaging.xyz:444", "https://app.builderlabstaging.xyz", "https://user@compose-ctrl.test.blockstaging.build", "http://localhost:8080", From 4e8e39d7e868990dfbb79496feea4230912fcddc Mon Sep 17 00:00:00 2001 From: Nathan Thillairajah Date: Thu, 15 Oct 2026 21:14:31 -0400 Subject: [PATCH 2/2] Accept migrated Public Compose HTTPS hostnames --- src/bl/apps.rs | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/src/bl/apps.rs b/src/bl/apps.rs index f52a232..cb34972 100644 --- a/src/bl/apps.rs +++ b/src/bl/apps.rs @@ -65,6 +65,8 @@ const TRUSTED_CONTROL_PLANE_HOSTS: &[&str] = &[ "compose-ctrl.apps.builderlabstaging.xyz", "compose-ctrl.public.builderlab.xyz", "compose-ctrl.public.builderlabstaging.xyz", + "compose-ctrl.builderlab.xyz", + "compose-ctrl.builderlabstaging.xyz", ]; pub fn command() -> Command { @@ -4900,11 +4902,15 @@ mod tests { "https://compose-ctrl.public.builderlab.xyz:443", "https://compose-ctrl.public.builderlabstaging.xyz", "https://compose-ctrl.public.builderlabstaging.xyz:443", + "https://compose-ctrl.builderlab.xyz", + "https://compose-ctrl.builderlab.xyz:443", + "https://compose-ctrl.builderlabstaging.xyz", + "https://compose-ctrl.builderlabstaging.xyz:443", "https://compose-ctrl.test.blockstaging.build:443", ] { assert!( ControlPlaneClient::new(trusted, "1.0.0", style).is_ok(), - "allowlisted control-plane origin should be accepted" + "allowlisted control-plane origin should be accepted: {trusted}" ); } @@ -4937,6 +4943,22 @@ mod tests { "https://user@compose-ctrl.public.builderlabstaging.xyz", "https://compose-ctrl.public.builderlabstaging.xyz.attacker.example", "https://compose-ctrl.public.builderlabstaging.xyz:444", + "http://compose-ctrl.builderlab.xyz", + "https://user@compose-ctrl.builderlab.xyz", + "https://:password@compose-ctrl.builderlab.xyz", + "https://compose-ctrl.builderlab.xyz@attacker.example", + "https://compose-ctrl.builderlab.xyz.attacker.example", + "https://attacker.compose-ctrl.builderlab.xyz", + "https://compose-ctrl.builderlab.xyz:80", + "https://compose-ctrl.builderlab.xyz:444", + "http://compose-ctrl.builderlabstaging.xyz", + "https://user@compose-ctrl.builderlabstaging.xyz", + "https://:password@compose-ctrl.builderlabstaging.xyz", + "https://compose-ctrl.builderlabstaging.xyz@attacker.example", + "https://compose-ctrl.builderlabstaging.xyz.attacker.example", + "https://attacker.compose-ctrl.builderlabstaging.xyz", + "https://compose-ctrl.builderlabstaging.xyz:80", + "https://compose-ctrl.builderlabstaging.xyz:444", "https://app.builderlabstaging.xyz", "https://user@compose-ctrl.test.blockstaging.build", "http://localhost:8080",