diff options
| author | Rafael França <rafaelmfranca@gmail.com> | 2019-01-23 13:15:15 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-01-23 13:15:15 -0500 |
| commit | d1456e3ad52cdab6d2fa07ef3f239631a20a9a1f (patch) | |
| tree | 670c52ede3e7d169fb89893d6f01f245c8fa74fd | |
| parent | 3aa094c52773f769380dc88710ad581bff92014d (diff) | |
| parent | 4dfb1a39611d97f83dd7431261128def7dbca5fe (diff) | |
| download | rails-d1456e3ad52cdab6d2fa07ef3f239631a20a9a1f.tar.gz rails-d1456e3ad52cdab6d2fa07ef3f239631a20a9a1f.tar.bz2 rails-d1456e3ad52cdab6d2fa07ef3f239631a20a9a1f.zip | |
Merge pull request #34993 from schuetzm/allow-subdomains-of-localhost
Subdomains of localhost are safe against DNS rebinding
| -rw-r--r-- | railties/lib/rails/application/configuration.rb | 2 | ||||
| -rw-r--r-- | railties/test/application/configuration_test.rb | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/railties/lib/rails/application/configuration.rb b/railties/lib/rails/application/configuration.rb index d5a66b6ec1..b7838f7e32 100644 --- a/railties/lib/rails/application/configuration.rb +++ b/railties/lib/rails/application/configuration.rb @@ -30,7 +30,7 @@ module Rails @filter_parameters = [] @filter_redirect = [] @helpers_paths = [] - @hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), "localhost"] if Rails.env.development?)) + @hosts = Array(([IPAddr.new("0.0.0.0/0"), IPAddr.new("::/0"), ".localhost"] if Rails.env.development?)) @public_file_server = ActiveSupport::OrderedOptions.new @public_file_server.enabled = true @public_file_server.index_name = "index" diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb index 3e979ea20d..9da3956dda 100644 --- a/railties/test/application/configuration_test.rb +++ b/railties/test/application/configuration_test.rb @@ -2289,6 +2289,11 @@ module ApplicationTests MESSAGE end + test "the host whitelist includes .localhost in development" do + app "development" + assert_includes Rails.application.config.hosts, ".localhost" + end + private def force_lazy_load_hooks yield # Tasty clarifying sugar, homie! We only need to reference a constant to load it. |