contour
contour copied to clipboard
HTTPProxy: Validate literal host rewrites are valid hostnames
We should validate that when using https://github.com/projectcontour/contour/blob/bbccbffc5be5f9ccf9c42b2153ae4339a55b2b88/apis/projectcontour/v1/httpproxy.go#L1270-L1274 and rewriting the Host header with a literal hostname (not dynamic hostname that comes from another header) that is is a valid value so we do not pass invalid hostnames to Envoy to rewrite and cause issues in rejected config or in the request that gets to the backend.
hm, might be good to do in a follow up but we should maybe be validating this doesn't get through to Envoy since this is a completely invalid hostname
Originally posted by @sunjayBhatia in https://github.com/projectcontour/contour/pull/5678#discussion_r1340636536
Hey can i try this? can you please assign me?
Yep @DHRUVKHANDELWAL00 assigned! Please let us know if you need any assistance on this, thanks for taking it on 👍🏽
We should validate that when using
https://github.com/projectcontour/contour/blob/bbccbffc5be5f9ccf9c42b2153ae4339a55b2b88/apis/projectcontour/v1/httpproxy.go#L1270-L1274
and rewriting the Host header with a literal hostname (not dynamic hostname that comes from another header) that is is a valid value so we do not pass invalid hostnames to Envoy to rewrite and cause issues in rejected config or in the request that gets to the backend.
hm, might be good to do in a follow up but we should maybe be validating this doesn't get through to Envoy since this is a completely invalid hostname
Originally posted by @sunjayBhatia in #5678 (comment)
@sunjayBhatia Do we need to create a function for type HeadersPolicy struct{}
for validating the hostnames? can you guide me about what should be my exact approach. Thank you.