豆豆友情提示:这是一个非官方 GitHub 代理镜像,主要用于网络测试或访问加速。请勿在此进行登录、注册或处理任何敏感信息。进行这些操作请务必访问官方网站 github.com。 Raw 内容也通过此代理提供。
Skip to content

Fix crash with terraform modules using host:port sources#14541

Merged
jurre merged 4 commits intomainfrom
jurre/fix-terraform-host-port-crash
Mar 27, 2026
Merged

Fix crash with terraform modules using host:port sources#14541
jurre merged 4 commits intomainfrom
jurre/fix-terraform-host-port-crash

Conversation

@jurre
Copy link
Copy Markdown
Member

@jurre jurre commented Mar 26, 2026

What

Fixes #12782

When a Terraform module source includes a port in the hostname (e.g., registry.terraform.io:443/terraform-aws-modules/vpc/aws), the RegistryClient#url_for method crashes with URI::InvalidComponentError.

Why

Ruby's URI#host= only accepts a hostname, not host:port. The url_for method was assigning the full hostname string (which may include a port) directly to uri.host:

uri.host = hostname  # hostname = "registry.terraform.io:443" → crash!

How

Split the hostname into host and port components before assigning them to the URI:

host, port = hostname.split(":", 2)
uri.host = host
uri.port = port.to_i if port

This is the minimal fix — it keeps hostname as-is throughout the class (preserving token lookup in headers_for) and only splits when constructing URIs.

Local verification

Reproduced the issue end-to-end with the Dependabot CLI using a local repo containing the exact manifest from the issue:

Before (published image):

updater | +-------------------------------+---------------+
updater | | terraform-aws-modules/vpc/aws | unknown_error |
updater | +-------------------------------+---------------+

After (rebuilt image with fix):

updater | +---------+-------------------------------------------------------+
updater | | created | terraform-aws-modules/vpc/aws ( from 5.5.1 to 6.6.0 ) |
updater | +---------+-------------------------------------------------------+

When a Terraform module source includes a port in the hostname
(e.g., registry.terraform.io:443/terraform-aws-modules/vpc/aws),
the RegistryClient#url_for method crashed with URI::InvalidComponentError
because URI#host= doesn't accept host:port format.

Fix by splitting the hostname into host and port components before
assigning them to the URI separately.

Fixes #12782

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@jurre jurre requested a review from a team as a code owner March 26, 2026 14:11
Copilot AI review requested due to automatic review settings March 26, 2026 14:11
@github-actions github-actions bot added the L: terraform Terraform packages label Mar 26, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a Terraform registry client crash when module sources include host:port by correctly separating host and port when constructing service URLs, and adds regression coverage.

Changes:

  • Update RegistryClient#url_for to split hostname into host and port before assigning to URI.
  • Add a registry client spec covering hostname values that include a port.
  • Add a Terraform fixture + parser spec asserting registry_hostname preserves the port from registry sources.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
terraform/lib/dependabot/terraform/registry_client.rb Fix URI construction for registries configured as host:port.
terraform/spec/dependabot/terraform/registry_client_spec.rb Regression spec ensuring service discovery + module version fetch uses the configured port.
terraform/spec/dependabot/terraform/file_parser_spec.rb Spec ensuring registry module sources with ports are parsed into registry_hostname correctly.
terraform/spec/fixtures/projects/registry_with_port/main.tf Fixture project containing a module source with registry.terraform.io:443/....

Comment thread terraform/lib/dependabot/terraform/registry_client.rb Outdated
jurre and others added 2 commits March 26, 2026 17:06
Instead of naive string splitting, use URI.parse("https://#{hostname}")
to properly handle IPv6 literals and reject invalid port values.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@jurre jurre enabled auto-merge March 27, 2026 05:44
Copy link
Copy Markdown
Contributor

@AbhishekBhaskar AbhishekBhaskar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jurre jurre disabled auto-merge March 27, 2026 07:37
@jurre jurre merged commit 532192b into main Mar 27, 2026
86 checks passed
@jurre jurre deleted the jurre/fix-terraform-host-port-crash branch March 27, 2026 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

L: terraform Terraform packages

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash with terraform modules with host:port sources

3 participants