mirrors
/
rails
mirror of https://github.com/rails/rails
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

Subdomains of localhost are safe against DNS rebinding

This commit is contained in:
Marc Schütz 2019-01-20 12:55:31 +01:00
parent 9608b180bf
commit 4dfb1a3961
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
railties/lib/rails/application/configuration.rb
View File

@ -30,7 +30,7 @@ module Rails
@filter_parameters = []
@filter_redirect = []
@helpers_paths = []
@hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), "localhost"] if Rails.env.development?))
@hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), ".localhost"] if Rails.env.development?))
@public_file_server = ActiveSupport::OrderedOptions.new
@public_file_server.enabled = true
@public_file_server.index_name = "index"

5
railties/test/application/configuration_test.rb
View File

@ -2289,6 +2289,11 @@ module ApplicationTests
MESSAGE
end
test "the host whitelist includes .localhost in development" do
app "development"
assert_includes Rails.application.config.hosts, ".localhost"
end
private
def force_lazy_load_hooks
yield # Tasty clarifying sugar, homie! We only need to reference a constant to load it.