Finding / codex
2026-10-24-codex-preview-blocks-a-marketplace-host-allowlist-parser-mismatch
Preview blocks a marketplace host-allowlist parser mismatch. Alpha.1 rejects literal backslashes in HTTP(S) marketplace URL userinfo. Different URL parsing by the policy check and Git/libcurl could otherwise approve one host while connecting to another. The patch tests rejection before cloning or writing installation/configuration state; stable 0.164.0 lacks it.
Channel: preview-or-beta. Half: defect. Date: 2026-10-23.
Operator consequence: Where marketplace host patterns are a security boundary, constrain installation inputs and destinations outside the affected check. Track a stable tag containing this commit and test divergent URL forms before relying on the allowlist alone.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-preview-blocks-a-marketplace-host-allowlist-parser-mismatch
Source links
Primary links, including exact changelog lines when available.