[Hardik K (hardikkaurani)]

Description

This PR strengthens host validation and normalization in AllowedHostsValidator:

1. Host normalization & prefix validation:

   • AllowedHostsValidator.__init__ now delegates to set_allowed_hosts to maintain a single normalization path.
   • Trims leading and trailing whitespace from host entries (host.strip()) before storing and checking prefixes.
   • Performs case-insensitive checks for http:// and https:// prefixes (e.g., catching HTTP://... or http://...), raising ValueError consistently.
   • Enforces element type validation (isinstance(host, str)), raising TypeError if a non-string entry is provided.

2. URL validation & security hardening:

   • Strips leading and trailing whitespace from the candidate URL before parsing.
   • Rejects URLs containing userinfo (o.username or o.password) outright to prevent host spoofing and credential leakage (aligning with the TypeScript implementation).
   • Validates URL structure (scheme, netloc, and hostname) before considering allowed_hosts empty fallback, ensuring malformed URLs are rejected even when allowed hosts are not configured.

3. Test coverage:

   • Added unit tests covering whitespace trimming, uppercase/padded prefix rejection, non-string element rejection, userinfo rejection, and malformed URL handling.

cc Vincent Biret (@baywet)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Hardik K (hardikkaurani)]

Hi Vincent Biret (@baywet), opened this PR to normalize allowed hosts, reject URLs with userinfo, and validate URL structure. Unit tests and SonarCloud analysis are all passing. Whenever you have time, please review. Thank you!