fix(config): reject WebSocket URL fragments at parse boundary

2026-09-05 21:27:29 +08:00
parent 053302c5df
commit 58c974e114
2 changed files with 9 additions and 1 deletions
@@ -69,7 +69,7 @@ function normalizeWebSocketUrl(value: string): string {
  }
  try {
    const parsed = new URL(url);
-    if (!value || /\s/.test(value) || !parsed.hostname || parsed.username || parsed.password
+    if (!value || /\s/.test(value) || url.includes('#') || !parsed.hostname || parsed.username || parsed.password
      || (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:')) throw new Error('invalid');
  } catch {
    throw new ConfigParseError('Invalid remote server: malformed WebSocket URL');