contour icon indicating copy to clipboard operation
contour copied to clipboard

HTTPProxy: Validate literal host rewrites are valid hostnames

Open sunjayBhatia opened this issue 1 year ago • 4 comments

We should validate that when using https://github.com/projectcontour/contour/blob/bbccbffc5be5f9ccf9c42b2153ae4339a55b2b88/apis/projectcontour/v1/httpproxy.go#L1270-L1274 and rewriting the Host header with a literal hostname (not dynamic hostname that comes from another header) that is is a valid value so we do not pass invalid hostnames to Envoy to rewrite and cause issues in rejected config or in the request that gets to the backend.

          hm, might be good to do in a follow up but we should maybe be validating this doesn't get through to Envoy since this is a completely invalid hostname

Originally posted by @sunjayBhatia in https://github.com/projectcontour/contour/pull/5678#discussion_r1340636536

sunjayBhatia avatar Sep 29 '23 18:09 sunjayBhatia

Hey can i try this? can you please assign me?

DHRUVKHANDELWAL00 avatar Oct 01 '23 09:10 DHRUVKHANDELWAL00

Yep @DHRUVKHANDELWAL00 assigned! Please let us know if you need any assistance on this, thanks for taking it on 👍🏽

sunjayBhatia avatar Oct 03 '23 14:10 sunjayBhatia

We should validate that when using

https://github.com/projectcontour/contour/blob/bbccbffc5be5f9ccf9c42b2153ae4339a55b2b88/apis/projectcontour/v1/httpproxy.go#L1270-L1274

and rewriting the Host header with a literal hostname (not dynamic hostname that comes from another header) that is is a valid value so we do not pass invalid hostnames to Envoy to rewrite and cause issues in rejected config or in the request that gets to the backend.

          hm, might be good to do in a follow up but we should maybe be validating this doesn't get through to Envoy since this is a completely invalid hostname

Originally posted by @sunjayBhatia in #5678 (comment)

@sunjayBhatia Do we need to create a function for type HeadersPolicy struct{} for validating the hostnames? can you guide me about what should be my exact approach. Thank you.

satyazzz123 avatar Nov 02 '23 15:11 satyazzz123