From 7fba8922e1540741240555560cc9504342bdb091 Mon Sep 17 00:00:00 2001
From: Christian Cleberg <hello@cleberg.net>
Date: Wed, 18 Mar 2026 19:16:02 -0500
Subject: Guard authenticated text fetches to sr.ht hosts and add regression
 test

---
 Hutch/Networking/SRHTClient.swift | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'Hutch/Networking/SRHTClient.swift')

diff --git a/Hutch/Networking/SRHTClient.swift b/Hutch/Networking/SRHTClient.swift
index a24fe24..6032cab 100644
--- a/Hutch/Networking/SRHTClient.swift
+++ b/Hutch/Networking/SRHTClient.swift
@@ -435,6 +435,9 @@ final class SRHTClient: Sendable {
         guard let token = _token.withLock({ $0 }), !token.isEmpty else {
             throw SRHTError.unauthorized
         }
+        guard Self.isTrustedAuthenticatedTextURL(url) else {
+            throw SRHTError.invalidAuthenticatedURL(url)
+        }
 
         var request = URLRequest(url: url)
         request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
@@ -512,6 +515,17 @@ final class SRHTClient: Sendable {
 
 // MARK: - Data Helper
 
+private extension SRHTClient {
+    static func isTrustedAuthenticatedTextURL(_ url: URL) -> Bool {
+        guard url.scheme?.localizedCaseInsensitiveCompare("https") == .orderedSame,
+              let host = url.host?.lowercased() else {
+            return false
+        }
+
+        return host.hasSuffix(".sr.ht")
+    }
+}
+
 private extension Data {
     mutating func append(_ string: String) {
         if let data = string.data(using: .utf8) {
-- 
cgit v1.2.3