adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 00:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

add custom error handling for host mismatch; ensure TrustHosts runs

Browse Source 
before TrustProxies
This commit is contained in:
Gregor Vostrak
2026-08-02 18:09:46 +02:00
parent 32f2f1431b
commit 80d98b30a1
4 changed files with 116 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
app/Exceptions/Handler.php
View File

@@ -6,7 +6,10 @@ namespace App\Exceptions;
use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler; use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
use Illuminate\Http\RedirectResponse; use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Throwable; use Throwable;
class Handler extends ExceptionHandler class Handler extends ExceptionHandler
@@ -30,6 +33,29 @@ class Handler extends ExceptionHandler
$this->reportable(function (Throwable $e): void { $this->reportable(function (Throwable $e): void {
// //
}); });
// A request on an untrusted host (see App\Http\Middleware\TrustHosts)
// otherwise renders as a bare "Bad request." 400. Show a message that
// says how to fix it instead. The framework has already converted the
// SuspiciousOperationException into a BadRequestHttpException by the time
// renderables run, so we match that and inspect the original.
$this->renderable(function (BadRequestHttpException $e, Request $request): ?Response {
$previous = $e->getPrevious();
if (! $previous instanceof SuspiciousOperationException
|| ! str_starts_with($previous->getMessage(), 'Untrusted Host')) {
return null; // any other bad request keeps the default response
}
$message = 'This hostname is not configured for this instance. '
.'Set APP_URL, or add the host to TRUSTED_HOSTS.';
if ($request->expectsJson()) {
return response()->json(['message' => $message], 400);
}
return response()->view('errors.untrusted-host', ['message' => $message], 400);
});
} }
public function render($request, Throwable $e): Response|RedirectResponse public function render($request, Throwable $e): Response|RedirectResponse

2
app/Http/Kernel.php
View File

@@ -48,8 +48,8 @@ class Kernel extends HttpKernel
*/ */
protected $middleware = [ protected $middleware = [
ForceHttps::class, ForceHttps::class,
TrustProxies::class,
TrustHosts::class, TrustHosts::class,
TrustProxies::class,
HandleCors::class, HandleCors::class,
PreventRequestsDuringMaintenance::class, PreventRequestsDuringMaintenance::class,
ValidatePostSize::class, ValidatePostSize::class,

49
resources/views/errors/untrusted-host.blade.php Normal file
View File

@@ -0,0 +1,49 @@
{{-- Self-contained on purpose: this page is rendered for a request on an
untrusted host, so it must not call url()/route()/asset(), which would
re-trigger Host validation and throw again. --}}
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Untrusted host</title>
<style>
html, body { height: 100%; margin: 0; }
body {
display: flex;
align-items: center;
justify-content: center;
background: #f5f5f5;
color: #1f2937;
font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
}
.card {
max-width: 32rem;
margin: 1.5rem;
padding: 2rem;
background: #fff;
border: 1px solid #e5e7eb;
border-radius: 0.75rem;
box-shadow: 0 1px 2px rgba(0, 0, 0, 0.05);
}
h1 { margin: 0 0 0.75rem; font-size: 1.25rem; }
p { margin: 0; line-height: 1.6; color: #4b5563; }
code {
padding: 0.1rem 0.35rem;
background: #f3f4f6;
border-radius: 0.25rem;
font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
font-size: 0.9em;
}
</style>
</head>
<body>
<div class="card">
<h1>Untrusted host</h1>
<p>
This hostname is not configured for this instance. Set
<code>APP_URL</code>, or add the host to <code>TRUSTED_HOSTS</code>.
</p>
</div>
</body>
</html>

41
tests/Feature/TrustHostsTest.php
View File

@@ -5,7 +5,10 @@ declare(strict_types=1);
namespace Tests\Feature; namespace Tests\Feature;
use App\Http\Middleware\TrustHosts; use App\Http\Middleware\TrustHosts;
use Illuminate\Contracts\Debug\ExceptionHandler;
use Illuminate\Http\Request; use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
use Symfony\Component\HttpFoundation\Response;
use Tests\TestCase; use Tests\TestCase;
class TrustHostsTest extends TestCase class TrustHostsTest extends TestCase
@@ -42,7 +45,7 @@ class TrustHostsTest extends TestCase
private function accepts(Request $request): bool private function accepts(Request $request): bool
{ {
$this->middleware()->handle($request, fn (): string => 'passed'); $this->middleware()->handle($request, fn (Request $request): Response => new Response('passed'));
try { try {
$request->getHost(); $request->getHost();
@@ -121,4 +124,40 @@ class TrustHostsTest extends TestCase
$this->assertTrue($this->accepts(Request::create('https://0.0.0.0/health-check/up'))); $this->assertTrue($this->accepts(Request::create('https://0.0.0.0/health-check/up')));
$this->assertTrue($this->accepts(Request::create('http://localhost/health-check/up'))); $this->assertTrue($this->accepts(Request::create('http://localhost/health-check/up')));
} }
public function test_health_check_endpoint_clears_state_before_other_middleware_reads_the_host(): void
{
// Simulate trusted-host state left by a previous request in an Octane worker.
Request::setTrustedHosts(['^app\.example\.com$']);
$this->get(self::CANONICAL.'/health-check/up', ['Host' => '0.0.0.0'])
->assertSuccessful()
->assertExactJson(['success' => true]);
}
public function test_untrusted_host_renders_a_helpful_error(): void
{
$handler = app(ExceptionHandler::class);
$exception = new SuspiciousOperationException('Untrusted Host "evil.example.com".');
$response = $handler->render(Request::create('https://evil.example.com/login'), $exception);
$this->assertSame(400, $response->getStatusCode());
$this->assertStringContainsString('TRUSTED_HOSTS', (string) $response->getContent());
}
public function test_untrusted_host_returns_json_for_api_clients(): void
{
$handler = app(ExceptionHandler::class);
$exception = new SuspiciousOperationException('Untrusted Host "evil.example.com".');
$request = Request::create('https://evil.example.com/api/v1/users');
$request->headers->set('Accept', 'application/json');
$response = $handler->render($request, $exception);
$this->assertSame(400, $response->getStatusCode());
$this->assertJson((string) $response->getContent());
$this->assertStringContainsString('TRUSTED_HOSTS', (string) $response->getContent());
}
} }