Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Validate host #966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Validate host #966

wants to merge 2 commits into from

Conversation

@pluknet
Copy link
Contributor

@pluknet pluknet commented Nov 6, 2025 •
edited
Loading

This series has some additional changes compared to previously posted on https://mailman.nginx.org/pipermail/nginx-devel/2024-June/KLY6JC27JZLSWBIOF6DT2FDDPIMDWWYK.html, most notably changes to stream, some minor though important fixes, rebase after c8c7beb and its proposed simplification via the ngx_http_validate_host() interface change.

See updated tests on my local branch:
https://github.com/pluknet/nginx-tests/tree/host

@pluknet pluknet added this to the nginx-1.29.4 milestone Nov 6, 2025
@pluknet pluknet requested a review from arut November 6, 2025 10:13
@pluknet pluknet self-assigned this Nov 6, 2025
arut
arut reviewed Nov 10, 2025
View reviewed changes
arut
arut reviewed Nov 10, 2025
View reviewed changes
arut
arut reviewed Nov 10, 2025
View reviewed changes
arut
arut reviewed Nov 10, 2025
View reviewed changes
@pluknet
Improved host header validation.
ab609aa 
It is rewritten based on ngx_http_parse_request_line() to follow
RFC 3986 host ABNF.  Notably, the following is now restricted:
- a port subcomponent with invalid values
- IP literals with a trailing dot and/or missing closing bracket
@pluknet
Changed interface of ngx_http_validate_host().
b9723da
@pluknet
Copy link
Contributor Author

pluknet commented Nov 13, 2025 •
edited
Loading

Changes:

  • removed request line hardening, it ought to be some legacy basic parser we would rather not touch, the main work to validate host should go in ngx_http_validate_host(). (although host in request target absolute form has precedence over the host header), "HTTP/1.1 clients will only send them in requests to proxies")
  • removed DNS label host interpretation, historically we were quite liberal here, allowing various experiments, changing this may be not a good idea
  • as a result, ngx_http_validate_host() keeps different parsing rules, the patch series was simplified to follow just wide RFC 3986 syntax.
  • see https://github.com/pluknet/nginx-tests/tree/host for updated tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@arut arut arut left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@pluknet pluknet

Labels

enhancement

Projects

None yet

Milestone

nginx-1.29.4

Development

Successfully merging this pull request may close these issues.

2 participants

@pluknet @arut