From 1ca9a4153c1cf4cf11c17987400609acbd87504b Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Tue, 14 Dec 2021 14:51:36 -0800 Subject: [PATCH] Merge pull request #43868 from rails/fix-default-hosts Allow localhost with a port by default in development --- .../action_dispatch/middleware/host_authorization.rb | 2 ++ actionpack/test/dispatch/host_authorization_test.rb | 12 ++++++++++++ railties/lib/rails/application/configuration.rb | 2 +- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/actionpack/lib/action_dispatch/middleware/host_authorization.rb b/actionpack/lib/action_dispatch/middleware/host_authorization.rb index ca2b17cb8b..a690cce866 100644 --- a/actionpack/lib/action_dispatch/middleware/host_authorization.rb +++ b/actionpack/lib/action_dispatch/middleware/host_authorization.rb @@ -10,6 +10,8 @@ module ActionDispatch # application will be executed and rendered. If no +response_app+ is given, a # default one will run, which responds with +403 Forbidden+. class HostAuthorization + ALLOWED_HOSTS_IN_DEVELOPMENT = [".localhost", /\A([a-z0-9-]+\.)?localhost:\d+\z/, IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")] + class Permissions # :nodoc: def initialize(hosts) @hosts = sanitize_hosts(hosts) diff --git a/actionpack/test/dispatch/host_authorization_test.rb b/actionpack/test/dispatch/host_authorization_test.rb index 8b29dabf0c..c0bd0432f4 100644 --- a/actionpack/test/dispatch/host_authorization_test.rb +++ b/actionpack/test/dispatch/host_authorization_test.rb @@ -143,6 +143,18 @@ class HostAuthorizationTest < ActionDispatch::IntegrationTest assert_equal "Custom", body end + test "localhost works in dev" do + @app = ActionDispatch::HostAuthorization.new(App, ActionDispatch::HostAuthorization::ALLOWED_HOSTS_IN_DEVELOPMENT) + + get "/", env: { + "HOST" => "localhost:3000", + "action_dispatch.show_detailed_exceptions" => true + } + + assert_response :ok + assert_match "Success", response.body + end + test "blocks requests with spoofed X-FORWARDED-HOST" do @app = ActionDispatch::HostAuthorization.new(App, [IPAddr.new("127.0.0.1")]) diff --git a/railties/lib/rails/application/configuration.rb b/railties/lib/rails/application/configuration.rb index cdaf507c7d..e87dab37a8 100644 --- a/railties/lib/rails/application/configuration.rb +++ b/railties/lib/rails/application/configuration.rb @@ -31,7 +31,7 @@ def initialize(*) @filter_parameters = [] @filter_redirect = [] @helpers_paths = [] - @hosts = Array(([".localhost", IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0")] if Rails.env.development?)) + @hosts = Rails.env.development? ? ActionDispatch::HostAuthorization::ALLOWED_HOSTS_IN_DEVELOPMENT : [] @public_file_server = ActiveSupport::OrderedOptions.new @public_file_server.enabled = true @public_file_server.index_name = "index" -- 2.39.2