You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by rn...@apache.org on 2015/07/20 15:04:11 UTC
[1/2] couch commit: updated refs/heads/master to 668ef5e
Repository: couchdb-couch
Updated Branches:
refs/heads/master 0529539e6 -> 668ef5e5d
Validate host header
By default, the Host header must be either localhost or the
fully-qualified domain name of the host.
Administrators can disable this check with;
[httpd]
validate_host = false
Administrators can override the valid host list with;
[httpd]
valid_hosts = foo,bar,baz
COUCHDB-2752
Project: http://git-wip-us.apache.org/repos/asf/couchdb-couch/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-couch/commit/fcd24e73
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-couch/tree/fcd24e73
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-couch/diff/fcd24e73
Branch: refs/heads/master
Commit: fcd24e73d65f2594f7d40bae7e9ec512a58a8c39
Parents: 8b4af21
Author: Robert Newson <rn...@apache.org>
Authored: Fri Jul 17 17:51:59 2015 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Mon Jul 20 13:25:24 2015 +0100
----------------------------------------------------------------------
src/couch_httpd.erl | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-couch/blob/fcd24e73/src/couch_httpd.erl
----------------------------------------------------------------------
diff --git a/src/couch_httpd.erl b/src/couch_httpd.erl
index 3260721..7e66cc3 100644
--- a/src/couch_httpd.erl
+++ b/src/couch_httpd.erl
@@ -30,6 +30,7 @@
-export([send_json/2,send_json/3,send_json/4,last_chunk/1,parse_multipart_request/3]).
-export([accepted_encodings/1,handle_request_int/5,validate_referer/1,validate_ctype/2]).
-export([http_1_0_keep_alive/2]).
+-export([validate_host/1]).
start_link() ->
start_link(http).
@@ -293,6 +294,7 @@ handle_request_int(MochiReq, DefaultFun,
{ok, Resp} =
try
+ validate_host(HttpReq),
check_request_uri_length(RawUri),
case couch_httpd_cors:is_preflight_request(HttpReq) of
#httpd{} ->
@@ -357,6 +359,38 @@ handle_request_int(MochiReq, DefaultFun,
couch_stats:increment_counter([couchdb, httpd, requests]),
{ok, Resp}.
+validate_host(#httpd{} = Req) ->
+ case config:get_boolean("httpd", "validate_host", true) of
+ true ->
+ Host = hostname(Req),
+ ValidHosts = valid_hosts(),
+ case lists:member(Host, ValidHosts) of
+ true ->
+ ok;
+ false ->
+ throw({bad_request, <<"Invalid host header">>})
+ end;
+ false ->
+ ok
+ end.
+
+hostname(#httpd{} = Req) ->
+ case header_value(Req, "Host") of
+ undefined ->
+ undefined;
+ Host ->
+ [Name | _] = re:split(Host, ":[0-9]+$", [{parts, 2}, {return, list}]),
+ Name
+ end.
+
+valid_hosts() ->
+ case config:get("httpd", "valid_hosts") of
+ undefined ->
+ ["localhost", "127.0.0.1", "[::1]", net_adm:localhost()];
+ List ->
+ re:split(List, ",", [{return, list}])
+ end.
+
check_request_uri_length(Uri) ->
check_request_uri_length(Uri, config:get("httpd", "max_uri_length")).
[2/2] couch commit: updated refs/heads/master to 668ef5e
Posted by rn...@apache.org.
Merge remote-tracking branch 'cloudant/2752-validate-host'
Project: http://git-wip-us.apache.org/repos/asf/couchdb-couch/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-couch/commit/668ef5e5
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-couch/tree/668ef5e5
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-couch/diff/668ef5e5
Branch: refs/heads/master
Commit: 668ef5e5d1392ea6e20e9a15e473002feb2ce399
Parents: 0529539 fcd24e7
Author: Robert Newson <rn...@apache.org>
Authored: Mon Jul 20 14:03:49 2015 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Mon Jul 20 14:03:49 2015 +0100
----------------------------------------------------------------------
src/couch_httpd.erl | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
----------------------------------------------------------------------