From 5e7baa9d0ab5c4185007effddf18b201107b25c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Thu, 21 Mar 2024 11:01:23 +0800
Subject: [PATCH] PublicIP: error out if non-http protocol is specified

---
 src/detection/publicip/publicip.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/detection/publicip/publicip.c b/src/detection/publicip/publicip.c
index b2e1f641f..b5038e66e 100644
--- a/src/detection/publicip/publicip.c
+++ b/src/detection/publicip/publicip.c
@@ -20,7 +20,16 @@ void ffPreparePublicIp(FFPublicIpOptions* options)
     else
     {
         FF_STRBUF_AUTO_DESTROY host = ffStrbufCreateCopy(&options->url);
-        ffStrbufSubstrAfterFirstS(&host, "://");
+        uint32_t hostStartIndex = ffStrbufFirstIndexS(&host, "://");
+        if (hostStartIndex < host.length)
+        {
+            if (hostStartIndex != 4 || !ffStrbufStartsWithIgnCaseS(&host, "http"))
+            {
+                fputs("Error: only http: protocol is supported. Use `Command` module with `curl` if needed\n", stderr);
+                exit(1);
+            }
+            ffStrbufSubstrAfter(&host, hostStartIndex + (strlen("://") - 1));
+        }
         uint32_t pathStartIndex = ffStrbufFirstIndexC(&host, '/');
 
         FF_STRBUF_AUTO_DESTROY path = ffStrbufCreate();