Expose all the options for HostAuthorization

sinatra · dentarg · Nov 18, 2024 · Nov 5, 2024 · Nov 8, 2024 · Nov 8, 2024
commit c9c26253d509aaeb1ec334376ddfd834a424e8a5
diff --git a/README.md b/README.md
@@ -1992,6 +1992,25 @@ set :protection, :session => true
       <tt>"development"</tt> if not available.
     </dd>
 
+  <dt>host_authorization</dt>
+  <dd>
+    You can pass a hash of options to <tt>host_authorization</tt>,
+    to be used by the <tt>Rack::Protection::HostAuthorization</tt> middleware.
+  <dd>
+  <dd>
+    The middleware can block requests with unrecognized hostnames, to prevent DNS rebinding
+    and other host header attacks. It checks the <tt>Host</tt>, <tt>X-Forwarded-Host</tt>
+    and <tt>Forwarded</tt> headers.
+  </dd>
+  <dd>
+    Useful options are:
+    <ul>
+      <li><tt>permitted_hosts</tt> – an array of hostnames your app recognizes, if empty all hostnames are permitted</li>
+      <li><tt>status</tt> – the HTTP status code used in the response when a request is blcoked</li>
+      <li><tt>message</tt> – the body used in the response when a request is blocked</li>
+      <li><tt>allow_if</tt> – supply a <tt>Proc</tt> to use custom allow/deny logic, the proc is passed the request environment</li>
+  </dd>
+
   <dt>logging</dt>
     <dd>Use the logger.</dd>
 
@@ -2014,16 +2033,6 @@ set :protection, :session => true
     paths.
   </dd>
 
-  <dt>permitted_hosts</dt>
-    <dd>
-      An array of hostnames your app recognizes. Requests with an unrecognized hostname
-      will be stopped to prevent DNS rebinding and other host header attacks.
-      Checks the <tt>Host</tt>, <tt>X-Forwarded-Host</tt> and <tt>Forwarded</tt> headers.
-    </dd>
-    <dd>
-      By default the array is empty and all hostnames are permitted.
-    </dd>
-
   <dt>port</dt>
     <dd>Port to listen on. Only used for built-in server.</dd>
 

diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
@@ -1867,8 +1867,7 @@ def setup_protection(builder)
       end
 
       def setup_host_authorization(builder)
-        options = { permitted_hosts: permitted_hosts }
-        builder.use Rack::Protection::HostAuthorization, options
+        builder.use Rack::Protection::HostAuthorization, host_authorization
       end
 
       def setup_sessions(builder)
@@ -1936,7 +1935,7 @@ def force_encoding(*args)
     set :sessions, false
     set :session_store, Rack::Session::Cookie
     set :logging, false
-    set :permitted_hosts, []
+    set :host_authorization, {}
     set :protection, true
     set :method_override, false
     set :use_code, false

diff --git a/test/helpers_test.rb b/test/helpers_test.rb
@@ -273,7 +273,7 @@ def status_app(code, &block)
 
     it 'stops requests to non-permitted hosts' do
       mock_app do
-        set :permitted_hosts, ['example.com']
+        set :host_authorization, { permitted_hosts: ['example.com'] }
 
         get('/') { redirect '/foo' }
       end

diff --git a/test/host_authorization_test.rb b/test/host_authorization_test.rb
@@ -6,7 +6,7 @@ class HostAuthorization < Minitest::Test
   it "allows requests based on the permitted hosts specified" do
     allowed_host = "allowed.org"
     mock_app do
-      set :permitted_hosts, [allowed_host]
+      set :host_authorization, { permitted_hosts: [allowed_host] }
 
       get("/") { "OK" }
     end
@@ -22,7 +22,7 @@ class HostAuthorization < Minitest::Test
   it "stops requests based on the permitted hosts specified" do
     allowed_host = "allowed.org"
     mock_app do
-      set :permitted_hosts, [allowed_host]
+      set :host_authorization, { permitted_hosts: [allowed_host] }
 
       get("/") { "OK" }
     end
@@ -37,7 +37,48 @@ class HostAuthorization < Minitest::Test
 
   it "allows any requests when no permitted hosts are specified" do
     mock_app do
-      set :permitted_hosts, []
+      set :host_authorization, { permitted_hosts: [] }
+
+      get("/") { "OK" }
+    end
+
+    headers = { "HTTP_HOST" => "some-host.org" }
+    request = Rack::MockRequest.new(@app)
+    response = request.get("/", headers)
+
+    assert_equal 200, response.status
+    assert_equal "OK", response.body
+  end
+
+  it "stops the request using the configured response" do
+    allowed_host = "allowed.org"
+    status = 418
+    message = "No coffee for you"
+    mock_app do
+      set :host_authorization, {
+        permitted_hosts: [allowed_host],
+        status: status,
+        message: message,
+      }
+
+      get("/") { "OK" }
+    end
+
+    headers = { "HTTP_HOST" => "bad-host.org" }
+    request = Rack::MockRequest.new(@app)
+    response = request.get("/", headers)
+
+    assert_equal status, response.status
+    assert_equal message, response.body
+  end
+
+  it "allows custom logic with 'allow_if'" do
+    allowed_host = "allowed.org"
+    mock_app do
+      set :host_authorization, {
+        permitted_hosts: [allowed_host],
+        allow_if: ->(_env) { true },
+      }
 
       get("/") { "OK" }
     end