Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow underscores in trusted hosts #6304

Merged
merged 1 commit into from Sep 29, 2014
Merged

Conversation

stackcoder
Copy link
Contributor

Underscores are valid characters in domain names, so don't prohibit them in trustedHosts[].
Also the domain name should be validated before creating the list with an invalid entry.

Underscores are valid characters in domain names, so don't prohibit them in trustedHosts[].
Also the domain name should be validated before creating the list with an invalid entry.
@mattab
Copy link
Member

mattab commented Sep 26, 2014

AFAIK the hostname does not allow _ character.... According to Wikipedia:

While a hostname may not contain other characters, such as the underscore character (_), other DNS names may contain the underscore.[3]

and some other page: http://domainkeys.sourceforge.net/underscore.html

Typically, the provider notes that underscores are prohibited from use in DNS.

If I'm wrong can you point to some RFC or example?

@mattab mattab closed this Sep 26, 2014
@mattab mattab added the wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it. label Sep 26, 2014
@stackcoder
Copy link
Contributor Author

For the hostname itself you're totally right; but the trusted hosts list dosn't contain only correct hostnames. At the moment only a few special characters are prohibited:

// Only punctuation we allow is '[', ']', ':', '.' and '-'
$hostLength = strlen($host);
if ($hostLength !== strcspn($host, '`~!@#$%^&*()_+={}\\|;"\'<>,?/ ')) {
  • [ : ] allowed only in IPv6 addresses
  • . allowed to concat DNS lables (e.g. subdomains) and IPv4 addresses
  • - possible usage in hostnames / DNS labels

Many other characters (especially the most of the Unicode ones) are invalid for hostnames too, but depending on the toplevel domain they are legal and currently allowed here.

A good summary could be found here: http://stackoverflow.com/questions/2180465/can-someone-have-a-subdomain-hostname-with-an-underscore-in-it
Your Wikipedia qoute also points out that underscores are valid in DNS names.

@mattab mattab reopened this Sep 29, 2014
mattab pushed a commit that referenced this pull request Sep 29, 2014
Allow underscores in trusted hosts
@mattab mattab merged commit 8d36655 into matomo-org:master Sep 29, 2014
@mattab
Copy link
Member

mattab commented Sep 29, 2014

Thanks for insisting, merged it as I don't think it could cause any problem yet it solves a bug for you. cheers!

@stackcoder stackcoder deleted the patch-2 branch September 30, 2014 19:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants