prevent Host header injection attacks

2026-10-26 15:08:51 +00:00 · 2026-08-17 22:18:59 +02:00
parent f3c390e0e0
commit 7f77cf0268
5 changed files with 17 additions and 1 deletions
--- a/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
+++ b/commafeed-server/src/main/java/com/commafeed/CommaFeedApplication.java
@@ -41,6 +41,11 @@ public class CommaFeedApplication {
            ImageProxyUrl.generateKey();
        }

+        if (config.passwordRecoveryEnabled() && config.passwordRecoveryPublicBaseUrl().isEmpty()) {
+            throw new IllegalStateException(
+                    "password recovery is enabled but no public base url is set");
+        }
+
        feedRefreshEngine.start();
        taskScheduler.start();
    }