security::secure_hostname_p (public)

 security::secure_hostname_p host

Defined in packages/acs-tcl/tcl/security-procs.tcl

Check, if the content of host is a "secure" value, which means, it is either white-listed or belongs to a non-public IP address, such it cannot harm in redirect operations.

Parameters:

host (required)

Returns:

boolean value

Partial Call Graph (max 5 caller/called nodes):

Testcases:

No testcase defined.

Source code:

    #
    # If the host has an non-public IP address (such as
    # e.g. "localhost") it is regarded as "secure". The first test is
    # the most simple case, working for all versions of NaviServer or
    # AOLserver.
    #
    if {$host in {localhost 127.0.0.1 ::1}} {
        return 1
    }

    #
    # RFC 6761 §6.4 defines .invalid as a special-use domain.
    #
    if {[regexp -nocase {(^|\.)invalid\.?$} $host]} {
        if {[ns_conn isconnected]} {
            ns_return 400 text/plain "Unrecognized Host header"
            ad_script_abort
        }
        return 0
    }

    set validationOk 0
    if {[acs::icanuse "ns_ip"]} {
        #
        # Check, if the address is not public. It resolves the
        # $hostName and checks the properties of the first IP address
        # returned.
        #
        try {
            ns_addrbyhost $host
        } on ok {result} {
            set validationOk [expr {![ns_ip public $result]}]
        } trap {NS_DNS NOT_FOUND} {} {
            # Continue with the configured host and host-node checks.
        } trap {NS_DNS} {message options} {
            set reason [lindex [dict get $options -errorcode] 1]
            ns_log warning  "security::secure_hostname_p: DNS $reason for Host [list $host]: $message"
        } on error {errorMsg} {
            ns_log warning  "security::secure_hostname_p: DNS lookup for host header value '$host' failed: $errorMsg"
        }
    }

    return $validationOk

Generic XQL file:

packages/acs-tcl/tcl/security-procs.xql

PostgreSQL XQL file:

packages/acs-tcl/tcl/security-procs-postgresql.xql

Oracle XQL file:

packages/acs-tcl/tcl/security-procs-oracle.xql