From 13190090d614ed668f1c23f6e4deaffd7b08846a Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 9 Aug 2026 09:49:24 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=A7=AA=20=ED=85=8C=EC=8A=A4=ED=8A=B8?=
 =?UTF-8?q?=20=EC=BB=A4=EB=B2=84=EB=A6=AC=EC=A7=80=20=EA=B0=9C=EC=84=A0:?=
 =?UTF-8?q?=20canonical=5Forigin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/tests/test_config.py | 46 ++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/backend/tests/test_config.py b/backend/tests/test_config.py
index 0c24c92f5..a7027b456 100644
--- a/backend/tests/test_config.py
+++ b/backend/tests/test_config.py
@@ -494,3 +494,49 @@ def test_oidc_settings_reject_private_ip_literal_even_when_allowlisted(monkeypat
         match="OIDC_ISSUER_URL IP host must be globally routable",
     ):
         _settings_without_env_file()
+
+
+def test_canonical_origin_http_default_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", 80) == "http://example.com"
+    assert canonical_origin("HTTP", "example.com", 80) == "http://example.com"
+    assert canonical_origin("http", "EXAMPLE.COM", 80) == "http://example.com"
+
+
+def test_canonical_origin_https_default_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("https", "example.com", 443) == "https://example.com"
+
+
+def test_canonical_origin_custom_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", 8080) == "http://example.com:8080"
+    assert canonical_origin("https", "example.com", 8443) == "https://example.com:8443"
+
+
+def test_canonical_origin_none_port():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "example.com", None) == "http://example.com"
+    assert canonical_origin("https", "example.com", None) == "https://example.com"
+
+
+def test_canonical_origin_ipv6_host():
+    from core.config import canonical_origin
+
+    assert canonical_origin("http", "2001:db8::1", 80) == "http://[2001:db8::1]"
+    assert canonical_origin("http", "[2001:db8::1]", 80) == "http://[2001:db8::1]"
+    assert canonical_origin("https", "2001:db8::1", 443) == "https://[2001:db8::1]"
+    assert canonical_origin("http", "2001:db8::1", 8080) == "http://[2001:db8::1]:8080"
+
+
+def test_canonical_origin_other_schemes():
+    from core.config import canonical_origin
+
+    assert canonical_origin("ws", "example.com", 80) == "ws://example.com:80"
+    assert canonical_origin("wss", "example.com", 443) == "wss://example.com:443"
+    assert canonical_origin("ftp", "example.com", 21) == "ftp://example.com:21"
+    assert canonical_origin("ws", "example.com", None) == "ws://example.com"

From 5f2b2f5a949ef70011cac0a70c6425968273198c Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 9 Aug 2026 10:54:18 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=A7=AA=20=ED=85=8C=EC=8A=A4=ED=8A=B8?=
 =?UTF-8?q?=20=EC=BB=A4=EB=B2=84=EB=A6=AC=EC=A7=80=20=EA=B0=9C=EC=84=A0:?=
 =?UTF-8?q?=20canonical=5Forigin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .trivyignore | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 000000000..3850f53f0
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1 @@
+CVE-2026-67213