loader: reject remote file URL hosts

internal/file/url/url.go

@@ -28,6 +28,10 @@ func Clean(path string) (string, error) {
 			return "", fmt.Errorf("unsupported URL scheme: %v", path)
 		}
 
+		if url.Host != "" && url.Host != "localhost" {
+			return "", fmt.Errorf("file URL host must be empty or localhost: %v", path)
+		}
+
 		path = url.Path
 
 		// Trim leading slash on Windows if present. The url.Path field returned

internal/file/url/url_test.go

@@ -1,6 +1,9 @@
 package url
 
-import "testing"
+import (
+	"errors"
+	"testing"
+)
 
 func TestClean(t *testing.T) {
 
@@ -32,14 +35,25 @@ func TestClean(t *testing.T) {
 			input: "file:///a/b/c",
 			exp:   "/a/b/c",
 		},
+		{
+			input: "file://localhost/a/b/c",
+			exp:   "/a/b/c",
+		},
+		{
+			input: "file://server/share/a.rego",
+			err:   errors.New("file URL host must be empty or localhost: file://server/share/a.rego"),
+		},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.input, func(t *testing.T) {
 			goos = tc.goos
 			path, err := Clean(tc.input)
 			if tc.err != nil {
-				if err == nil || err == tc.err {
+				if err == nil {
+					t.Fatalf("Want err: %v but got: %v, err: %v", tc.err, path, err)
+				}
+				if err.Error() != tc.err.Error() {
 					t.Fatalf("Want err: %v but got: %v, err: %v", tc.err, path, err)
 				}
 			} else if err != nil || path != tc.exp {

v1/loader/loader_test.go

@@ -1285,6 +1285,13 @@ func TestUnsupportedURLScheme(t *testing.T) {
 	}
 }
 
+func TestRejectRemoteFileURLHost(t *testing.T) {
+	_, err := NewFileLoader().All([]string{"file://server/share/a.rego"})
+	if err == nil || !strings.Contains(err.Error(), "file URL host must be empty or localhost: file://server/share/a.rego") {
+		t.Fatal(err)
+	}
+}
+
 func TestSplitPrefix(t *testing.T) {
 
 	tests := []struct {