fix: validate Agones assigned endpoints

server/supervisor/supervisor.go

@@ -145,11 +145,11 @@ func (s *Supervisor) assignedEndpoint(ctx context.Context) (int, string, error)
 	if err := s.sdkGet(ctx, "/gameserver", &server); err != nil {
 		return 0, "", err
 	}
-	if len(server.Status.Ports) == 0 || server.Status.Address == "" {
+	if len(server.Status.Ports) == 0 || strings.TrimSpace(server.Status.Address) == "" || strings.ContainsAny(server.Status.Address, " \t\r\n") {
 		return 0, "", fmt.Errorf("Agones returned no assigned endpoint")
 	}
 	for _, port := range server.Status.Ports {
-		if port.Port > 0 && (port.Name == "game" || len(server.Status.Ports) == 1) {
+		if port.Port > 0 && port.Port <= 65535 && (port.Name == "game" || len(server.Status.Ports) == 1) {
 			return port.Port, server.Status.Address, nil
 		}
 	}

server/supervisor/supervisor_test.go

@@ -142,3 +142,28 @@ func TestDrainRequiresAndUsesAuthenticatedLocalEndpoint(t *testing.T) {
 		t.Fatal("unauthenticated drain was allowed")
 	}
 }
+
+func TestAssignedEndpointRejectsMalformedAddressAndPort(t *testing.T) {
+	for _, response := range []string{
+		`{"status":{"address":"203.0.113.9","ports":[{"name":"game","port":65536}]}}`,
+		`{"status":{"address":"   ","ports":[{"name":"game","port":31001}]}}`,
+		`{"status":{"address":"203.0.113.9 bad","ports":[{"name":"game","port":31001}]}}`,
+	} {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/gameserver" {
+				_, _ = w.Write([]byte(response))
+				return
+			}
+			w.WriteHeader(http.StatusOK)
+		}))
+		s, err := New(Config{Command: []string{"/bin/sh", "-c", "exit 0"}, SDKBaseURL: server.URL, ReadyURL: server.URL + "/probe", ReadyTimeout: time.Second})
+		if err != nil {
+			server.Close()
+			t.Fatal(err)
+		}
+		if err := s.Start(context.Background()); err == nil {
+			t.Errorf("malformed endpoint was accepted: %s", response)
+		}
+		server.Close()
+	}
+}