TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge pull request #34993 from schuetzm/allow-subdomains-of-localhost

Browse Source 
Subdomains of localhost are safe against DNS rebinding
This commit is contained in:
Rafael França 2019-01-23 13:15:15 -05:00 committed by GitHub
commit d1456e3ad5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
railties/lib/rails/application/configuration.rb
View File

@ -30,7 +30,7 @@ def initialize(*)
@filter_parameters = []
@filter_redirect = []
@helpers_paths = []
@hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), "localhost"] if Rails.env.development?))
@hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), ".localhost"] if Rails.env.development?))
@public_file_server = ActiveSupport::OrderedOptions.new
@public_file_server.enabled = true
@public_file_server.index_name = "index"

5
railties/test/application/configuration_test.rb
View File

@ -2289,6 +2289,11 @@ class MyLogger < ::Logger
MESSAGE
end
test "the host whitelist includes .localhost in development" do
app "development"
assert_includes Rails.application.config.hosts, ".localhost"
end
private
def force_lazy_load_hooks
yield # Tasty clarifying sugar, homie! We only need to reference a constant to load it.