| Subject: | [PATCH] Use only the first X_FORWARDED_HOST for building URLs. |
| Date: | Sat, 8 Sep 2012 09:33:45 -0400 |
| To: | bug-CGI.pm [...] rt.cpan.org |
| From: | Brett Smith <brettcsmith [...] brettcsmith.org> |
Hi,
I recently discovered an issue with an application using CGI.pm behind
a proxy. In some situations, it would create redirect URLs that
started with "http://example.org, example.org/". Turns out that
X-Forwarded-Host can include multiple comma-space-separated hosts.
Apache's mod_proxy documentation describes this in more detail.
As of this morning's git checkout, CGI.pm may use X-Forwarded-Host
verbatim in the host portion of a redirect URL. Since I'm pretty sure
a comma-space string will never work there, this patch has CGI.pm use
the first host named in X-Forwarded-Host.
Thanks,
---
lib/CGI.pm | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/lib/CGI.pm b/lib/CGI.pm
index f510680..080a4ec 100644
--- a/lib/CGI.pm
+++ b/lib/CGI.pm
@@ -2817,7 +2817,9 @@ sub url {
my $protocol = $self->protocol();
$url = "$protocol://";
my $vh = http('x_forwarded_host') || http('host') || '';
- $vh =~ s/\:\d+$//; # some clients add the port number (incorrectly). Get rid of it.
+ # If there's more than one forwarded host, use the first one.
+ $vh = (split(/, /, $vh))[0];
+ $vh =~ s/\:\d+$//; # some clients add the port number (incorrectly). Get rid of it.
$url .= $vh || server_name();
--
1.7.2.5