Merge commit from fork

* Validate Jupyter Server URLs

* Validate Jupyter Server URLs: address reviews

* Validate Jupyter Server URLs: address test reviews

* Validate Jupyter Server URLs: address test reviews

Author: victoriamaciver

internal/codespaces/rpc/invoker.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"net/url"
 	"os"
 	"regexp"
 	"strconv"
@@ -184,7 +185,11 @@ func (i *invoker) StartJupyterServer(ctx context.Context) (port int, serverUrl s
 		return 0, "", fmt.Errorf("failed to parse JupyterLab port: %w", err)
 	}
 
-	return port, response.ServerUrl, err
+	if !isJupyterServerURLValid(response.ServerUrl) {
+		return 0, "", fmt.Errorf("invalid JupyterLab server URL: %q", response.ServerUrl)
+	}
+
+	return port, response.ServerUrl, nil
 }
 
 // Rebuilds the container using cached layers by default or from scratch if full is true
@@ -311,3 +316,20 @@ func isUsernameValid(username string) bool {
 	re := regexp.MustCompile(validUsernamePattern)
 	return re.MatchString(username)
 }
+
+// Ensures that the Jupyter server URL is valid and points to a loopback http(s) URL
+func isJupyterServerURLValid(serverURL string) bool {
+	u, err := url.Parse(serverURL)
+	if err != nil {
+		return false
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return false
+	}
+	host := u.Hostname()
+	if strings.ToLower(host) == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}

internal/codespaces/rpc/invoker_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/cli/cli/v2/internal/codespaces/rpc/jupyter"
 	"github.com/cli/cli/v2/internal/codespaces/rpc/ssh"
 	rpctest "github.com/cli/cli/v2/internal/codespaces/rpc/test"
+	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 )
 
@@ -311,3 +312,58 @@ func TestStartSSHServerFailure(t *testing.T) {
 		t.Fatalf("expected %s, got %s", "", user)
 	}
 }
+
+func TestIsJupyterServerURLValid(t *testing.T) {
+	tests := []struct {
+		name      string
+		serverURL string
+		want      bool
+	}{
+		{
+			name:      "http loopback IPv4 with token",
+			serverURL: "http://127.0.0.1:1234/lab?token=abc",
+			want:      true,
+		},
+		{
+			name:      "https localhost",
+			serverURL: "https://localhost:8888/",
+			want:      true,
+		},
+		{
+			name:      "http loopback IPv6",
+			serverURL: "http://[::1]:9000/lab",
+			want:      true,
+		},
+		{
+			name:      "vscode-insiders scheme",
+			serverURL: "vscode-insiders://ms-vsliveshare.vsliveshare/join?foo=bar",
+			want:      false,
+		},
+		{
+			name:      "vscode scheme",
+			serverURL: "vscode://vscode.git/clone?url=https://example.com",
+			want:      false,
+		},
+		{
+			name:      "non-loopback host",
+			serverURL: "http://cli.github.com/lab",
+			want:      false,
+		},
+		{
+			name:      "file scheme",
+			serverURL: "file:///mona-home/document",
+			want:      false,
+		},
+		{
+			name:      "empty string",
+			serverURL: "",
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, isJupyterServerURLValid(tt.serverURL))
+		})
+	}
+}