Paste P7029

hostname sanity in generic VCL
ActivePublic
Actions

Authored by BBlack on Apr 23 2018, 1:51 PM.

Tags

Referenced Files

	F17265762: hostname sanity in generic VCL
	Apr 23 2018, 1:52 PM

	F17265758: hostname sanity in generic VCL
	Apr 23 2018, 1:51 PM

Subscribers

	--- a/modules/varnish/templates/vcl/wikimedia-frontend.vcl.erb
	+++ b/modules/varnish/templates/vcl/wikimedia-frontend.vcl.erb
	@@ -82,8 +82,14 @@ sub normalize_request {
	// Strip :port from req.http.host and normalize to lowercase
	set req.http.Host = std.tolower(regsub(req.http.Host, ":.*$", ""));

	- // Strip away characters that don't belong in hostnames
	- set req.http.Host = regsuball(req.http.Host, "[^-.a-z0-9]+", "");
	+ // Check that host header looks reasonably-legitimate/parseable now
	+ if (req.http.Host ~ "^[a-z][-a-z0-9](\.[a-z][-a-z0-9])*\.?$") {
	+ // Strip optional trailing terminal dot if present
	+ set req.http.Host = regsub(req.http.Host, "\.$", "");
	+ } else {
	+ set req.http.Host = "invalid";
	+ // XXX error 400 here for unparseable or empty hostnames
	+ }
	}

Event Timeline

BBlack created this paste.Apr 23 2018, 1:51 PM

BBlack edited the content of this paste. (Show Details)