Reject malformed preset download URLs

Preset downloads should fail early when a URL lacks a hostname, even if the scheme is HTTPS. The redirect error now describes any disallowed target instead of implying that only non-HTTPS redirects are blocked.

Author: darion-yaphet

src/specify_cli/presets/_commands.py

@@ -107,7 +107,9 @@ def preset_add(
             _parsed = _urlparse(from_url)
 
             def _is_allowed_download_url(parsed_url):
-                host = parsed_url.hostname or ""
+                host = parsed_url.hostname
+                if not host:
+                    return False
                 is_loopback = host == "localhost"
                 if not is_loopback:
                     try:
@@ -146,7 +148,11 @@ def _is_allowed_download_url(parsed_url):
                     with response_context as response:
                         final_url = response.geturl() if hasattr(response, "geturl") else from_url
                         if not _is_allowed_download_url(_urlparse(final_url)):
-                            console.print(f"[red]Error:[/red] Preset URL redirected to non-HTTPS URL: {final_url}")
+                            console.print(
+                                "[red]Error:[/red] Preset URL redirected to a disallowed URL: "
+                                f"{final_url}. Redirect targets must use HTTPS with a hostname, "
+                                "or HTTP for localhost/loopback."
+                            )
                             raise typer.Exit(1)
                         with zip_path.open("wb") as output:
                             try:

tests/test_presets.py

@@ -3877,6 +3877,49 @@ def fake_install_from_zip(self, zip_path, speckit_version, priority=10):
         assert exc_info.value.exit_code == 1
         assert installed is False
 
+    def test_preset_add_from_url_rejects_hostless_https_url(self, project_dir):
+        """URL installs reject HTTPS URLs without a hostname before downloading."""
+        from typer.testing import CliRunner
+        from unittest.mock import patch
+        from specify_cli import app
+
+        runner = CliRunner()
+        with patch.object(Path, "cwd", return_value=project_dir), \
+             patch("specify_cli.authentication.http.open_url") as open_url:
+            result = runner.invoke(app, ["preset", "add", "--from", "https:///preset.zip"])
+
+        assert result.exit_code == 1
+        assert "URL must use HTTPS" in strip_ansi(result.output)
+        open_url.assert_not_called()
+
+    def test_preset_add_from_url_redirect_error_describes_disallowed_url(self, project_dir, monkeypatch, capsys):
+        """Redirect rejection message covers hostless HTTPS, not only non-HTTPS URLs."""
+        import typer
+        from specify_cli.presets._commands import preset_add
+
+        class FakeResponse(io.BytesIO):
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, tb):
+                return False
+
+            def geturl(self):
+                return "https:///preset.zip"
+
+        monkeypatch.setattr("specify_cli._require_specify_project", lambda: project_dir)
+        monkeypatch.setattr("specify_cli.get_speckit_version", lambda: "0.6.0")
+        monkeypatch.setattr("specify_cli.authentication.http.open_url", lambda url, timeout: FakeResponse(b"zip"))
+        monkeypatch.setattr(PresetManager, "install_from_zip", lambda *args, **kwargs: None)
+
+        with pytest.raises(typer.Exit) as exc_info:
+            preset_add(preset_id=None, from_url="https://example.com/preset.zip", dev=None, priority=10)
+
+        assert exc_info.value.exit_code == 1
+        output = strip_ansi(capsys.readouterr().out)
+        assert "redirected to a disallowed URL" in output
+        assert "must use HTTPS with a hostname" in output
+
     def test_preset_add_from_url_streams_download_to_zip(self, project_dir, monkeypatch):
         """URL installs stream response bytes to disk before installing the ZIP."""
         from specify_cli.presets._commands import preset_add