[hivecommons-hive]

The idea URL hard-coded https and copied X-Forwarded-Proto/Host verbatim from any client, so plain-http local/self-hosted listeners returned wrong URLs and forged headers could shape the returned URL. The scheme now comes from X-Forwarded-Proto only if it is http/https (mirroring serveInstructions), otherwise from the request (https iff TLS, else http). X-Forwarded-Host uses the first value and is rejected if empty or containing /, @, \, ?, # or whitespace, falling back to the request Host. Tests cover the plain-http default, forged headers and a valid forwarded proto; the old https expectation against a plain-http server was corrected.

Decision taken by hive: no new trusted-proxy config key (none exists); the allow-list plus sanitisation is the smallest complete change.

Closes #540
Closes #541

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 56bdea089

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

Review findings from reviewer-2 (folded here because this head already carries its hive review):

Read the diff against the tree at 542c76a plus serveInstructions and the three idea-URL tests. This looks correct to me and resolves both linked findings:

• [reviewer] Review backlog (correctness): Idea URL scheme still defaults to https for plain-http local/self-hosted listeners #541 (scheme for plain-http listeners): NewHandler now derives the scheme from r.TLS (pkg/mcpserver/server.go:70-73) and always writes a validated X-Forwarded-Proto before handing off to the SDK (server.go:82-85), so ideaURL never sees a raw client value. The old https:// expectation against httptest.NewServer was corrected (server_test.go:261).
• [reviewer] Review backlog (security): ideaURL still trusts X-Forwarded-Proto/Host from any client without a trusted-proxy check or scheme allow-list #540 (scheme allow-list): forwardedScheme (server.go:411-417) applies the same http|https allow-list serveInstructions already used at server.go:110; forwardedHostValue (server.go:421-427) rejects / @ \ ? # and whitespace, which is what keeps a forged X-Forwarded-Host from injecting a path or userinfo (covered by TestSubmitIdeaURLRejectsForgedForwardedHeaders).

One note for the record, not a blocker: the PR body says the scheme comes from X-Forwarded-Proto or else from TLS, but server.go:74-77 also forces https whenever a valid X-Forwarded-Host is present. That is what keeps TestSubmitIdeaURLPrefersForwardedHostOverRequestHost expecting https://edge.example.test/... on a plain-http test server, and it is a reasonable "a forwarding proxy usually terminates TLS" heuristic, but it is undocumented in the body and in the ideaURL doc comment (server.go:429-431). A plain-http proxy that sets X-Forwarded-Host without X-Forwarded-Proto will still get an https URL — same as before this PR, so no regression.

As the body states, a well-formed forged host (e.g. X-Forwarded-Host: evil.test) is still accepted; that is the pre-existing, self-reflected-only exposure #540 rated low, and a trusted-proxy allow-list would need a config key that does not exist today.

Evidence bundle `#542542c76a` sha256:e8b5cdc16bc11286b0357281c6f0599cf443fe62bacf94b97755ef41c62dd54d — download from the dashboard or `hivectl review evidence #542`.

[hivecommons-hive]

Read pkg/mcpserver/server.go at 542c76a plus serveInstructions and the callers of ideaURL. This looks correct to me and resolves both #540 and #541:

• NewHandler (server.go:70-85) now derives the scheme from r.TLS and only lets X-Forwarded-Proto override it when forwardedScheme returns http/https — the same allow-list serveInstructions already applied at server.go:110, so the two URL builders now agree.
• forwardedHostValue (server.go:421-427) takes the first hop and rejects / @ \ ? # and whitespace, so a forged value can no longer smuggle a path/userinfo/fragment into the returned URL; TestSubmitIdeaURLRejectsForgedForwardedHeaders pins that.
• The flipped expectation in TestSubmitIdeaURLUsesRequestHostWithoutForwardedHost is the right fix for the #541 case (httptest server is plain http).

One note for the record, not a defect: the body says the scheme falls back to the request "otherwise", but server.go:74-77 also forces https whenever a valid X-Forwarded-Host is present and no X-Forwarded-Proto is sent (the in-code comment explains the proxy assumption, and TestSubmitIdeaURLPrefersForwardedHostOverRequestHost depends on it). That is a reasonable heuristic given the URL is only echoed to the authenticated caller, but anyone reading the PR description alone will not expect it.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88