Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

api: disallow setting 'host' header directly #2275

Merged
merged 11 commits into from
May 17, 2022
Merged

api: disallow setting 'host' header directly #2275

merged 11 commits into from
May 17, 2022

Conversation

goaway
Copy link
Contributor

@goaway goaway commented May 12, 2022

Description: The ':authority' header is used to direct the connection internally and this is set when initializing the builder.

Fixes #2244.

Risk Level: Low
Testing: Unit

Signed-off-by: Mike Schore mike.schore@gmail.com

Signed-off-by: Mike Schore <mike.schore@gmail.com>
Copy link
Contributor

@Augustyniak Augustyniak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thank you for doing this Mike - can you update the version history file? Looks good otherwise I think

Signed-off-by: Mike Schore <mike.schore@gmail.com>
Augustyniak
Augustyniak previously approved these changes May 13, 2022
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
Signed-off-by: Mike Schore <mike.schore@gmail.com>
@goaway goaway requested a review from Augustyniak May 16, 2022 20:09
.
Signed-off-by: Mike Schore <mike.schore@gmail.com>
@goaway goaway merged commit ad7ac5e into main May 17, 2022
@goaway goaway deleted the ms/host-header branch May 17, 2022 01:00
jpsim added a commit that referenced this pull request May 17, 2022
* origin/main:
  api: disallow setting 'host' header directly (#2275)
  android: add support for registering a platform KV store (#2134)
  Bump Lyft Support Rotation (#2278)

Signed-off-by: JP Simard <jp@jpsim.com>
jpsim added a commit that referenced this pull request May 17, 2022
…atcher-again

* main:
  envoy: update to d88f31b (#2279)
  api: disallow setting 'host' header directly (#2275)
  android: add support for registering a platform KV store (#2134)
  Bump Lyft Support Rotation (#2278)
  tools: Enable the VSCode completion db to use bazelisk if available (#2277)

Signed-off-by: JP Simard <jp@jpsim.com>
jpsim added a commit that referenced this pull request May 17, 2022
* origin/main: (97 commits)
  docs: update python packages to work with Python 3.10 (#2286)
  test: adding a cancel test, cleaning up copy-paste code (#2283)
  envoy: update to d88f31b (#2279)
  api: disallow setting 'host' header directly (#2275)
  android: add support for registering a platform KV store (#2134)
  Bump Lyft Support Rotation (#2278)
  tools: Enable the VSCode completion db to use bazelisk if available (#2277)
  Release v0.4.6.20220513-4
  Fix android_release_deploy
  Release v0.4.6.20220513-3
  Release v0.4.6.20220513-2
  net: enable happy eyeballs by default (#2272)
  git: avoid merge conflicts when adding changelog entries (#2273)
  docs: fix sphinx reference mismatch warning (#2274)
  tests: add -Xcheck:jni to kotlin integration tests by default (#2269)
  configuration: enable h2 ping by default (#2270)
  Add version history entries for user-facing changes (#2271)
  configuration: filter unroutable addresses on Android by default (#2267)
  Integrate rules_xcodeproj (#2263)
  Add assert when failing to get_env (#2253)
  ...

Signed-off-by: JP Simard <jp@jpsim.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

when 'host and :authority` are both set on headers, it would fail DNS resolution
2 participants