[andrew]

nuget FetchVersions followed each catalog entry's @id to whatever host it named, so a hostile registry response could point it at loopback or cloud metadata addresses and get the body back as Integrity. It now only fetches catalog leaves on the same scheme and host as the registry base URL. nuget.org serves both from api.nuget.org, so integrity is unaffected there.

urlparser.removeSchemes stripped one prefix per iteration and re-lowercased the remaining string each time, so a repository field of GIT: repeated was quadratic (100 KB took about 12s). It now walks an offset with strings.EqualFold, and Clean and Normalize return "" for input over 4096 bytes.

The githubactions tag listing, golang pkgsite listing and swift registry listing kept paging for as long as the server said there was more. They now stop after core.MaxPages (1000) pages and return ErrTooManyPages, re-exported from the root package. For golang that falls back to the module proxy like any other pkgsite error.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[simonchrz]

Looks good to me. The removeSchemes rewrite gives the same output as before: a table of 26 inputs (mixed case, chained scm:git:, repeated schemes, non-ASCII case folds, invalid UTF-8) matched, and a 60s fuzz comparing the old and new implementation found no difference.

One thing in the nuget change: when a catalog @id redirects to another host, the rejected redirect comes back from HTTPClient.Do as a plain *url.Error, which client.open treats as retryable. So each version is tried MaxRetries times with backoff. With core.DefaultClient() and every @id redirecting to a CDN, 5 versions took about 8s and 30 requests, and integrity still ends up empty. Before, it was one followed redirect per version. Making the refusal non-retryable, or using no retries on catalogClient since integrity is best effort, would avoid that.

Smaller: sameOrigin compares Host as written, so a base URL with :443, or an http @id under an https base behind a TLS proxy, drops integrity without a log. nuget.org isn't affected.

[andrew]

@simonchrz Fixed the retry issue in 51a546b. The catalog client copy now uses MaxRetries = 0, since integrity is best effort. The shared client's retry settings are unchanged.

The redirect tests now use the default client and assert one attempt for rejected redirects and ten requests for a redirect loop. The public FetchVersions probe went from six catalog requests to one, with no request reaching the other origin.

[simonchrz]

LGTM, retry fix confirmed.