Add guard against DNS rebinding attacks (mastodon#16087)

* Add guard against DNS rebinding attacks * Fix not to apply to test environment
progval · Apr 21, 2021 · 8323023 · 8323023
1 parent e243092
commit 8323023
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/config/initializers/1_hosts.rb b/config/initializers/1_hosts.rb
@@ -26,4 +26,10 @@
       "ws://#{ENV['REMOTE_DEV'] == 'true' ? host.split(':').first : 'localhost'}:4000"
     end
   end
+
+  unless Rails.env.test?
+    config.hosts << host if host.present?
+    config.hosts << web_host if web_host.present?
+    config.hosts << alternate_domains if alternate_domains.present?
+  end
 end