1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
# frozen_string_literal: true
require 'rack/protection'
require 'ipaddr'
module Rack
module Protection
##
# Prevented attack:: DNS rebinding and other Host header attacks
# Supported browsers:: all
# More infos:: https://en.wikipedia.org/wiki/DNS_rebinding
# https://portswigger.net/web-security/host-header
#
# Blocks HTTP requests with an unrecognized hostname in any of the following
# HTTP headers: Host, X-Forwarded-Host, Forwarded
#
# If you want to permit a specific hostname, you can pass in as the `:permitted_hosts` option:
#
# use Rack::Protection::HostAuthorization, permitted_hosts: ["www.example.org", "sinatrarb.com"]
#
# The `:allow_if` option can also be set to a proc to use custom allow/deny logic.
class HostAuthorization < Base
DOT = '.'
PORT_REGEXP = /:\d+\z/.freeze
SUBDOMAINS = /[a-z0-9\-.]+/.freeze
private_constant :DOT,
:PORT_REGEXP,
:SUBDOMAINS
default_reaction :deny
default_options allow_if: nil,
message: 'Host not permitted'
def initialize(*)
super
@permitted_hosts = []
@domain_hosts = []
@ip_hosts = []
@all_permitted_hosts = Array(options[:permitted_hosts])
@all_permitted_hosts.each do |host|
case host
when String
if host.start_with?(DOT)
domain = host[1..-1]
@permitted_hosts << domain.downcase
@domain_hosts << /\A#{SUBDOMAINS}#{Regexp.escape(domain)}\z/i
else
@permitted_hosts << host.downcase
end
when IPAddr then @ip_hosts << host
end
end
end
def accepts?(env)
return true if options[:allow_if]&.call(env)
return true if @all_permitted_hosts.empty?
request = Request.new(env)
origin_host = extract_host(request.host_authority)
forwarded_host = extract_host(request.forwarded_authority)
debug env, "#{self.class} " \
"@all_permitted_hosts=#{@all_permitted_hosts.inspect} " \
"@permitted_hosts=#{@permitted_hosts.inspect} " \
"@domain_hosts=#{@domain_hosts.inspect} " \
"@ip_hosts=#{@ip_hosts.inspect} " \
"origin_host=#{origin_host.inspect} " \
"forwarded_host=#{forwarded_host.inspect}"
if host_permitted?(origin_host)
if forwarded_host.nil?
true
else
host_permitted?(forwarded_host)
end
else
false
end
end
private
def extract_host(authority)
authority.to_s.split(PORT_REGEXP).first&.downcase
end
def host_permitted?(host)
exact_match?(host) || domain_match?(host) || ip_match?(host)
end
def exact_match?(host)
@permitted_hosts.include?(host)
end
def domain_match?(host)
return false if host.nil?
return false if host.start_with?(DOT)
@domain_hosts.any? { |domain_host| host.match?(domain_host) }
end
def ip_match?(host)
@ip_hosts.any? { |ip_host| ip_host.include?(host) }
rescue IPAddr::InvalidAddressError
false
end
end
end
end
|
