{"version":"2.1.268","anchor":"url-host-parsing-hardened-against-protocol-relative-and-sche","canonical_anchor":"url-host-parsing-hardened-against-protocol-relative-and-sche","heading":"URL host parsing hardened against protocol-relative and scheme-prefixed strings","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/url-host-parsing-hardened-against-protocol-relative-and-sche","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### URL host parsing hardened against protocol-relative and scheme-prefixed strings\n\nURL host parsing now rejects scheme-prefixed strings and strips whitespace before building fallback URLs\n\n**What**\n\nBefore Claude Code builds a fallback `https:\/\/` URL out of a bare host string, it now checks whether that string already looks like it starts with a URL scheme (something like `foo:` at the start) and bails out if so, instead of blindly prepending `https:\/\/`. It also now strips tab, newline, carriage-return, and surrounding whitespace characters from the string before parsing it.\n\n**Why**\n\nThis closes off ways a crafted host string could be misinterpreted as pointing somewhere other than intended, such as smuggling in a different scheme or hiding characters in whitespace.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}