Repository navigation
Expand file tree
/
Copy pathTrustHosts.php
More file actions
52 lines (43 loc) · 1.61 KB
/
Copy pathTrustHosts.php
File metadata and controls
52 lines (43 loc) · 1.61 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
<?php
namespace ProcessMaker\Http\Middleware;
use Illuminate\Http\Middleware\TrustHosts as Middleware;
use Closure;
use Illuminate\Http\Request;
class TrustHosts extends Middleware
{
public function hosts(): array
{
$hosts = array_filter([
$this->allSubdomainsOfApplicationUrl(),
]);
$trustedHostsEnv = config('app.trusted_hosts_links', '');
if ($trustedHostsEnv !== '') {
foreach (array_filter(array_map('trim', explode(',', $trustedHostsEnv))) as $host) {
if (str_contains($host, '://')) {
$host = parse_url($host, PHP_URL_HOST) ?: $host;
}
$hosts[] = '^(.+\.)?' . preg_quote($host) . '$';
}
}
return array_values($hosts);
}
public function handle(Request $request, $next)
{
if ($request->hasHeader('X-Forwarded-Host')) {
$forwardedHost = $request->header('X-Forwarded-Host');
$trustedPattern = $this->allSubdomainsOfApplicationUrl();
if (!$this->hostIsValid($forwardedHost, $trustedPattern)) {
\Log::warning('Rejected request with untrusted X-Forwarded-Host', [
'forwarded_host' => $forwardedHost,
'trusted_pattern' => $trustedPattern
]);
abort(400, 'Invalid Host Header');
}
}
return parent::handle($request, $next);
}
protected function hostIsValid(string $host, string $pattern): bool
{
return preg_match('/' . str_replace('/', '\/', $pattern) . '/', $host) === 1;
}
}