Skip to content

NewClientFromEnv ignores the WithBaseURL error, silently sending the token to production on a malformed ZOO_HOST #410

Description

@sneg55

NewClientFromEnv ignores the WithBaseURL error, so a malformed ZOO_HOST silently sends your token to production

Context: API Makeathon participant. Found while reviewing client construction.

NewClientFromEnv calls c.WithBaseURL(host) but discards the returned error (lib.go:97-110). WithBaseURL can fail while parsing the URL. On failure the client keeps the production default server, and NewClientFromEnv still returns a nil error, so the caller believes it is pointed at their configured host.

Concrete failure

A user sets ZOO_HOST to a malformed or self-hosted endpoint intending to target another deployment. Parsing fails, the error is dropped, and the client silently retains https://api.zoo.dev. Requests, including the bearer token and payloads, go to production instead of the intended deployment.

Verify

Set ZOO_API_TOKEN to a sentinel and ZOO_HOST to %zz, then call NewClientFromEnv(). It returns no error and the client's server remains the default production URL.

Suggested fix

Propagate the WithBaseURL error out of NewClientFromEnv so a malformed ZOO_HOST fails loudly instead of silently falling back to production.

Environment

Reviewed against the current main of KittyCAD/kittycad.go.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions