rack-allowed_hosts 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 4e8a16d9cde4f0e3b7c9251ef74fad90b904c325
+  data.tar.gz: 9818c819bea2a4615cbbfca7585c8624dc85c181
+SHA512:
+  metadata.gz: 946e54aa8cc564612724ea61db8d72e46a63206a7a07190126cc20b4919ed1c975ed6e848dde71e12769234a1ec1dce5717ab2bbc6552cafe42197efb596fd41
+  data.tar.gz: 24b5a2422bd9aad43f059152601f856dce14bc79a062c7be075c04905935cea2cdd7b0955588dae11dc40b159bf8fcbfd0325a5c55872ed478bba3aad01239c8

data/lib/rack/allowed_hosts.rb

@@ -0,0 +1,71 @@
+require 'rack/allowed_hosts/version'
+
+# Rack::AllowedHosts
+module Rack
+  class AllowedHosts
+
+    attr_reader :allowed_hosts
+
+    def initialize(app, &block)
+      @app = app
+      @allowed_hosts = []
+
+      # Call the block
+      instance_eval(&block)
+    end
+
+    def allow(*hosts)
+      # Also allow the for `allow ['host-a.com', 'host-b.com']` etc.
+      if hosts.size == 1 && hosts[0].is_a?(Array)
+        hosts = hosts[0]
+      end
+
+      hosts.each do |host|
+        matcher = matcher_for(host)
+        @allowed_hosts << matcher unless @allowed_hosts.include? matcher
+      end
+    end
+
+    def call(env)
+      host = env['HTTP_HOST'].split(':').first
+      unless host_allowed?(host)
+        return [403, {'Content-Type' => 'text/html'}, ['<h1>403 Forbidden</h1>']]
+      end
+
+      # Fetch the result
+      @app.call(env)
+    end
+
+    def host_allowed?(host)
+      return false if host.nil?
+
+      @allowed_hosts.each do |pattern|
+        return true if pattern.match host
+      end
+
+      false
+    end
+
+    def matcher_for(host)
+      host = host.gsub(/\.\Z/, '')
+      parts = host.split('.')
+      pattern = nil
+      parts.each do |part|
+        if pattern.nil?
+          pattern = prepared_part(part)
+        else
+          pattern = /#{pattern}\.#{prepared_part(part)}/
+        end
+      end
+      /\A#{pattern}\Z/
+    end
+
+    def prepared_part(part)
+      if part == '*'
+        /.*/
+      else
+        Regexp.quote(part)
+      end
+    end
+  end
+end

data/lib/rack/allowed_hosts/version.rb

@@ -0,0 +1,6 @@
+module Rack
+  class AllowedHosts
+    VERSION = '0.0.1'
+  end
+end
+

metadata

@@ -0,0 +1,61 @@
+--- !ruby/object:Gem::Specification
+name: rack-allowed_hosts
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Jeremy Blalock
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-08-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: |2
+      Rack::AllowedHosts allows you to whitelist the hostnames allowed to
+      serve the site. This is helpful to protect against Host Header Injection.
+      See: https://acunetix.com/vulnerabilities/web/host-header-attack
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/rack/allowed_hosts.rb
+- lib/rack/allowed_hosts/version.rb
+homepage: 
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.0
+signing_key: 
+specification_version: 4
+summary: Simple token translation middleware
+test_files: []