Not sure where to put the suggestion, so it will be file-wide. I saw two tests for the corresponding Rails middleware that may be of interest here:

• https://github.com/rails/rails/blob/6230bd334ab47f9efc6d97c6627abe76c80d8058/actionpack/test/dispatch/host_authorization_test.rb#L108
• https://github.com/rails/rails/blob/6230bd334ab47f9efc6d97c6627abe76c80d8058/actionpack/test/dispatch/host_authorization_test.rb#L449

I will just copy the tests here for easier discussion (no need to open the link every time you visit this convo)

https://github.com/rails/rails/blob/6230bd334ab47f9efc6d97c6627abe76c80d8058/actionpack/test/dispatch/host_authorization_test.rb#L108

  test "does not allow domain name notation in the HOST header itself" do
    @app = build_app(".example.com")

    get "/", env: {
      "HOST" => ".example.com",
      "action_dispatch.show_detailed_exceptions" => true
    }

    assert_response :forbidden
    assert_match "Blocked hosts: .example.com", response.body
  end

https://github.com/rails/rails/blob/6230bd334ab47f9efc6d97c6627abe76c80d8058/actionpack/test/dispatch/host_authorization_test.rb#L449

  test "blocks requests with invalid hostnames" do
    @app = build_app(".example.com")

    get "/", env: {
      "HOST" => "attacker.com#x.example.com",
      "action_dispatch.show_detailed_exceptions" => true
    }

    assert_response :forbidden
    assert_match "Blocked hosts: attacker.com#x.example.com", response.body
  end

Both of these are not blocked currently.

I wonder of they can be taken advantage of 🤔 They are not valid hostnames (Wikipedia, see "LDH rule")

$ host example.com#example.org
Host example.com#example.org not found: 3(NXDOMAIN)

$ host .example.org
host: '.example.org' is not a legal name (empty label)

I handled them both in 9f0d130, no longer allowed.

I think there's one difference between Sinatra and Rails now: with .example.com in the list of permitted hosts, Rails will allow bar.example.com but not foo.bar.example.com. Sinatra will allow both. This is intentional, I think it makes sense. WDYT @walro?

Both ways seem acceptable to me. I guess for Rails one would need to add .bar.example.com in addition to .example.com to allow for foo.bar.example.com?

In the Sinatra case, to only allow foo.bar.example.com (and its siblings) but not baz.example.com, one could setup .bar.example.com?

Yes

Noticed an interesting comment in rack/rack#1604

Given RFC 2181 relaxes all restrictions on DNS names (except segment and total length), it seems unnecessarily risky to use anything but a wildcard match in that position.