Practice Mode • Secure Coding • easy

Runner Callback Allowlist

100 points

Validate a runner callback target.

Problem

You are implementing validate a runner callback target. The input is one JSON value. Return exactly the JSON or scalar result described by the examples, with stable ordering and no extra logging. Validate an HTTPS outbound target against a strict hostname allowlist and private-host denial. Explain your reasoning and complexity during interview review; the judge evaluates only the returned result.

Input contract

One UTF-8 JSON value matching the structures shown in the examples.

Output contract

One deterministic JSON value or scalar with no explanatory text.

Target complexity

O(a) allowlist checks

Judge protocol

function-stdin-json-v1

Examples

Example 1

Input: {"allowedHosts":["example.com"],"url":"https://api2.example.com/path"}
Output: true

This example demonstrates the core security invariant.

Example 2

Input: {"allowedHosts":["example.com"],"url":"http://example.com"}
Output: false

This example covers the empty or minimum boundary.

Constraints

Input is valid UTF-8 JSON and is at most 64 KB.
Output must be deterministic for identical input.
Do not use network access, persistent filesystem writes, subprocesses, or environment secrets.
Handle the empty or minimum boundary shown in the examples.

Progressive hints

Integrity: hidden tests, editorial solutions, and assessment-only cases are never sent to the browser as answer keys. Final execution occurs only in the separately isolated runner.

Execution unavailable until runner deployment and certificationdisabled • pending

Sign in to code

You can review the complete problem publicly. Sign in to save encrypted drafts and submit to the isolated runner.