When we use URI.parse("http://#{http_host}/"), we assume that http_host holds a valid, sanitized hostname. However, URI.parse is fairly permissive in what it accepts. This can lead to unexpected (and potentially unsafe) behavior if http_host is user-controlled or not rigorously validated before parsing. Attackers can craft unusual or malicious values to manipulate the resulting URI in ways that are not obviously valid domain names. The same applies to SERVER_NAME.
Below is a condensed list of potentially unusual or invalid values that URI.parse("http://#{string}/") would still parse:
-
Userinfo embedded
user:pass@evil.com
(Parses as http://user:pass@evil.com/)
-
Port numbers and paths
example.com:8080/path/to/endpoint
(Parses as http://example.com:8080/path/to/endpoint/)
-
Query or fragment
example.com?foo=bar#frag
(Parses as http://example.com?foo=bar#frag/)
When we use
URI.parse("http://#{http_host}/"), we assume thathttp_hostholds a valid, sanitized hostname. However,URI.parseis fairly permissive in what it accepts. This can lead to unexpected (and potentially unsafe) behavior ifhttp_hostis user-controlled or not rigorously validated before parsing. Attackers can craft unusual or malicious values to manipulate the resulting URI in ways that are not obviously valid domain names. The same applies toSERVER_NAME.Below is a condensed list of potentially unusual or invalid values that
URI.parse("http://#{string}/")would still parse:Userinfo embedded
user:pass@evil.com(Parses as
http://user:pass@evil.com/)Port numbers and paths
example.com:8080/path/to/endpoint(Parses as
http://example.com:8080/path/to/endpoint/)Query or fragment
example.com?foo=bar#frag(Parses as
http://example.com?foo=bar#frag/)