Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-09-22 20:14:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent Host header injection attacks

Browse Source
This commit is contained in:
Athou
2026-08-17 22:18:59 +02:00
parent f3c390e0e0
commit 7f77cf0268
5 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
commafeed-server/src/test/java/com/commafeed/integration/rest/UserIT.java
View File

@@ -52,6 +52,7 @@ class UserIT extends BaseIT {
RestAssured.given()
.body(req)
.contentType(ContentType.JSON)
.header("Host", "malicious.url.com")
.post("rest/user/passwordReset")
.then()
.statusCode(200);
@@ -64,6 +65,7 @@ class UserIT extends BaseIT {
Assertions.assertTrue(
message.getHtml()
.startsWith("You asked for password recovery for account 'admin'"));
Assertions.assertTrue(message.getHtml().contains("https://commafeed.example.com"));
Assertions.assertEquals("admin@commafeed.com", message.getTo().getFirst());
Element a = Jsoup.parse(message.getHtml()).select("a").getFirst();