From 862831063d979dad1539dc64bfa71fb5bc267cc4 Mon Sep 17 00:00:00 2001
From: qwenbona <qwenbona@users.noreply.github.com>
Date: Tue, 28 Jul 2026 01:19:27 +0200
Subject: [PATCH] fix(config): reject malformed domain labels

safeDomain accepted domains starting/ending with a dot and labels
starting/ending with a hyphen, which are invalid per RFC 1035 and can
cause unexpected URL construction. Reject both forms.

Fixes #51
---
 lib/config.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/config.ts b/lib/config.ts
index 3a76be4..42b771d 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -133,6 +133,8 @@ export function safeDomain(dn: unknown): string | null {
     .replace(/^https?:\/\//, "")
     .replace(/[/?#&].*$/, "");
   if (!/^[a-z0-9.-]{3,253}$/.test(d) || !d.includes(".") || d.includes("..")) return null;
+  if (d.startsWith(".") || d.endsWith(".")) return null;
+  if (d.split(".").some((label) => label.startsWith("-") || label.endsWith("-"))) return null;
   return d;
 }