umputun / reproxy / 41173744998

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix: block Host header injection into destinations, add ${host.N} (#268)

* fix: escape $ in host before $host substitution

a Host header may contain $, and the destination with the host substituted
is then expanded by the source regex. A request with Host $1.example.com
pulled path groups into the destination, so a rule like
*.example.com,^/(.*),http://$host:9/ could be steered to any upstream
host:port given in the path.

* feat: add ${host.N} for server regex groups in destination

a regex server can now pass its groups to the destination as ${host.1},
${host.2} and so on. A rule like ^([^.]+)\.example\.com$,^/(.*)$ with
destination https://${host.1}.foo.com/$1 maps aaaa.example.com/some to
aaaa.foo.com/some. Groups are substituted after $host and before the route
expansion, with $ escaped, so $1 keeps referring to the route groups. A
missing group, or a server without a regex, gives an empty string.

Related to https://github.com/umputun/reproxy/discussions/169

* fix: substitute $host and ${host.N} in a single pass

substituting $host first and ${host.N} on its result rescanned the inserted host. Over HTTP/2, where the Host may contain braces, a host like 1${host.1}.example.com left a bare $1 that expanded the path into the upstream authority. All host tokens are now replaced in one pass. README notes ${1} for a route group directly followed by a host token.

* fix: reject invalid Host headers before route matching

net/http rejects a Host with /, #, @ or braces for HTTP/1, but the HTTP/2 server passes :authority through as is. With ${host.N} or $host in the destination, an :authority like localhost/admin#.example.com sent the request to an upstream the client chose. matchHandler now answers 400 for a Host that fails httpguts.ValidHostHeader, so HTTP/2 gets the same check as HTTP/1.

* fix: reject % in Host, document raw host interpolation

httpguts.ValidHostHeader accepts %, and the destination path is decoded when parsed, so a Host like %2e%2e... (continued)

Coverage Stats

25 of 25 new or added lines in 2 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

2909 of 3586 relevant lines covered (81.12%)

89.67 hits per line