url() does not handle multi-valued X-Forwarded-Host [rt.cpan.org #54487]

[leejo]

https://rt.cpan.org/Ticket/Display.html?id=54487

The url() method in CGI.pm examines the X-Forwarded-Host header to
determine the vhost name, but does not cater for this header containing
a comma-separated list (which can happen if the request has passed
through multiple reverse proxies).

The apache documentation
<http://httpd.apache.org/docs/2.2/mod/mod_proxy.html> says:

"Be careful when using these headers on the origin server, since they
will contain more than one (comma-separated) value if the original
request already contained one of these headers."

The Catalyst code caters for this by taking the last value in the list.
The attached patch makes CGI.pm follow the same behaviour.

[leejo]

mark@summersault.com - 2010-02-10 17:08:12

The url() method in CGI.pm examines the X-Forwarded-Host header to
determine the vhost name, but does not cater for this header containing
a comma-separated list (which can happen if the request has passed
through multiple reverse proxies).

The apache documentation
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html says:

"Be careful when using these headers on the origin server, since they
will contain more than one (comma-separated) value if the original
request already contained one of these headers."

The Catalyst code caters for this by taking the last value in the list.
The attached patch makes CGI.pm follow the same behaviour.

Thanks for the report, Ray.

Would you be willing to add an automated test
to go with it?

Mark

[leejo]

raym - 2010-06-08 08:50:58

On Wed Feb 10 12:08:12 2010, mark@summersault.com wrote:

Would you be willing to add an automated test
to go with it?

Yes, of course. Please see attached patch which adds a test.

Ray.