fix: include rejected redirect target in error

Assisted-by: Codex (model: GPT-5, autonomous)

Author: PascalThuet

src/specify_cli/authentication/http.py

@@ -64,7 +64,7 @@ def _hostname_in_hosts(hostname: str, hosts: tuple[str, ...]) -> bool:
 def _validate_strict_redirect(_old_url: str, new_url: str) -> None:
     if not is_https_or_localhost_http(new_url):
         raise urllib.error.URLError(
-            "unsafe redirect: target must use HTTPS with a hostname, "
+            f"unsafe redirect to {new_url}: target must use HTTPS with a hostname, "
             "or HTTP for localhost (127.0.0.1, ::1)"
         )
 

tests/test_authentication.py

@@ -882,6 +882,25 @@ def test_redirect_rejects_https_downgrade(self):
             handler.redirect_request(req, io.BytesIO(b""), 302, "Found", {},
                                      "http://evil.example.com/archive.zip")
 
+    def test_strict_redirect_error_describes_target_and_allowed_localhost(self):
+        from specify_cli.authentication.http import _StripAuthOnRedirect
+        from urllib.request import Request
+        import io
+        import urllib.error
+
+        handler = _StripAuthOnRedirect(("example.com",))
+        req = Request("https://example.com/archive.zip")
+
+        with pytest.raises(urllib.error.URLError) as exc_info:
+            handler.redirect_request(req, io.BytesIO(b""), 302, "Found", {},
+                                     "http://evil.example.com/archive.zip")
+
+        error_message = str(exc_info.value)
+        assert "http://evil.example.com/archive.zip" in error_message
+        assert "localhost" in error_message
+        assert "127.0.0.1" in error_message
+        assert "::1" in error_message
+
 
 # ---------------------------------------------------------------------------
 # _fetch_latest_release_tag delegation