NewClientFromEnv ignores the WithBaseURL error, so a malformed ZOO_HOST silently sends your token to production
Context: API Makeathon participant. Found while reviewing client construction.
NewClientFromEnv calls c.WithBaseURL(host) but discards the returned error (lib.go:97-110). WithBaseURL can fail while parsing the URL. On failure the client keeps the production default server, and NewClientFromEnv still returns a nil error, so the caller believes it is pointed at their configured host.
Concrete failure
A user sets ZOO_HOST to a malformed or self-hosted endpoint intending to target another deployment. Parsing fails, the error is dropped, and the client silently retains https://api.zoo.dev. Requests, including the bearer token and payloads, go to production instead of the intended deployment.
Verify
Set ZOO_API_TOKEN to a sentinel and ZOO_HOST to %zz, then call NewClientFromEnv(). It returns no error and the client's server remains the default production URL.
Suggested fix
Propagate the WithBaseURL error out of NewClientFromEnv so a malformed ZOO_HOST fails loudly instead of silently falling back to production.
Environment
Reviewed against the current main of KittyCAD/kittycad.go.
NewClientFromEnvignores theWithBaseURLerror, so a malformedZOO_HOSTsilently sends your token to productionContext: API Makeathon participant. Found while reviewing client construction.
NewClientFromEnvcallsc.WithBaseURL(host)but discards the returned error (lib.go:97-110).WithBaseURLcan fail while parsing the URL. On failure the client keeps the production default server, andNewClientFromEnvstill returns a nil error, so the caller believes it is pointed at their configured host.Concrete failure
A user sets
ZOO_HOSTto a malformed or self-hosted endpoint intending to target another deployment. Parsing fails, the error is dropped, and the client silently retainshttps://api.zoo.dev. Requests, including the bearer token and payloads, go to production instead of the intended deployment.Verify
Set
ZOO_API_TOKENto a sentinel andZOO_HOSTto%zz, then callNewClientFromEnv(). It returns no error and the client's server remains the default production URL.Suggested fix
Propagate the
WithBaseURLerror out ofNewClientFromEnvso a malformedZOO_HOSTfails loudly instead of silently falling back to production.Environment
Reviewed against the current
mainof KittyCAD/kittycad.go.