mirror of https://github.com/zulip/zulip.git
e4b4f67b44
If a Zulip install at example.org got a request at an HTTP `Host` like foo.example.org.evil.com (or even foo.example.orgevil.com), we would accept it as subdomain foo. This isn't likely to happen in practice because it shouldn't pass ALLOWED_HOSTS, and it's not obvious to me that anything untoward could be done with it even if ALLOWED_HOSTS were set wide open, but if nothing else it multiplies the cases in analyzing this logic. The reason we had a loose match like this, I assume, is to allow the user to come from arbitrary ports -- especially in development. So tighten the pattern to allow just that, and add some tests for that behavior and a comment explaining why this complication is needed. |
||
|---|---|---|
| .. | ||
| fixtures | ||
| lib | ||
| management | ||
| migrations | ||
| templatetags | ||
| tests | ||
| tornado | ||
| views | ||
| webhooks | ||
| worker | ||
| __init__.py | ||
| apps.py | ||
| context_processors.py | ||
| decorator.py | ||
| filters.py | ||
| forms.py | ||
| logging_handlers.py | ||
| middleware.py | ||
| models.py | ||
| signals.py | ||
| static_header.txt | ||
| storage.py | ||