🐛 bug: reject malformed hostnames in hostauthorization wildcard path by gaby · Pull Request #4408 · gofiber/fiber

gaby · 2026-06-06T11:59:26Z

Motivation

Prevent wildcard AllowedHosts from accepting malformed authority strings that can bypass subdomain checks (e.g. attacker.test/.example.com).
Ensure the host-authorization middleware enforces that a normalized authority is a syntactically valid IP or DNS name before exact/wildcard matching.
Keep wildcard semantics while closing an authz bypass introduced by raw strings.HasSuffix over insufficiently validated host input.

Description

Added isValidHostSyntax(host string) bool to middleware/hostauthorization/hostauthorization.go to validate normalized host syntax (accept IP literals or RFC-style DNS labels and reject delimiters/whitespace, empty labels, labels with leading/trailing hyphens, and oversize labels).
Call isValidHostSyntax from parseNormalizedAuthority to reject malformed hosts early before matchHost runs.
Added regression cases to Test_ParseNormalizedAuthority in middleware/hostauthorization/hostauthorization_test.go for inputs containing /, ?, and spaces to ensure these are rejected.

Testing

Ran make audit which executed but failed due to govulncheck reporting multiple Go stdlib vulnerabilities in the pinned toolchain (go1.25.1), causing a non-zero exit (scan output reported numerous standard-library issues). (failed)
Ran make generate; the generation step completed successfully. (passed)
Ran make betteralign; completed successfully. (passed)
Ran make modernize; failed in this environment because the modernize tool requires Go >= 1.26 while the CI/toolchain uses go1.25.1. (failed)
Ran make format; completed successfully. (passed)
Ran make lint; linter passed with 0 issues after a minor gocritic suggestion was addressed. (passed)
Ran make test; full test suite executed successfully (3417 tests, 2 skipped). (passed)

Codex Task

coderabbitai · 2026-06-06T11:59:39Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3a8ad70d-c25f-46d4-a765-5786628de8b8

📥 Commits

Reviewing files that changed from the base of the PR and between 3d2864d and 3cf7534.

📒 Files selected for processing (1)

middleware/hostauthorization/hostauthorization_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

middleware/hostauthorization/hostauthorization_test.go

Walkthrough

A new isValidHostSyntax helper validates normalized hosts (rejecting empty, leading/trailing/consecutive dots, invalid labels; accepting IP literals). parseNormalizedAuthority calls this validator and returns failure for invalid hosts. Tests now assert rejection for hosts containing '/', '?', or whitespace and for multi-trailing-dot with a port.

Changes

Host Syntax Validation

Layer / File(s)	Summary
Host syntax validation and test coverage `middleware/hostauthorization/hostauthorization.go`, `middleware/hostauthorization/hostauthorization_test.go`	`isValidHostSyntax` added to validate host syntax (accept IP literals via `net.ParseIP`; reject empty hosts and leading/trailing/consecutive dots; enforce per-label rules: non-empty, within max label length, no leading/trailing `-`, ASCII letters/digits/hyphen). `parseNormalizedAuthority` now calls this validator and returns failure for invalid hosts. Tests updated to reject `api.example.com...:443` and to add negative cases for hosts containing `/`, `?`, or whitespace.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

gofiber/fiber#4293: Modifies hostauthorization host validation and test coverage for malformed authority inputs.
gofiber/fiber#4291: Adds early rejection of invalid/empty normalized host values in hostauthorization middleware.
gofiber/fiber#4307: Changes trailing-dot normalization in authority parsing which interacts with this PR's validation.

Suggested reviewers

sixcolors
ReneWerner87
efectn

Poem

🐰 I hopped the host-check garden gate,
I sniffed for dots that duplicate,
IPs I greet, labels must behave,
No slashes, queries, whitespace to save —
A careful rabbit guards the Host name's fate.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title references rejecting malformed hostnames in hostauthorization, which directly aligns with the main change: adding validation to reject syntactically invalid hosts before wildcard matching.
Description check	✅ Passed	The description covers motivation, implementation details, and testing results comprehensively. However, it does not check all template sections: no explicit type of change selection, no documentation updates mentioned, and no checklist items formally completed.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix-wildcard-host-authorization-vulnerability

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces a host syntax validation helper isValidHostSyntax to the host authorization middleware to prevent invalid hosts (such as those containing path or query delimiters, or spaces) from being accepted, along with corresponding unit tests. A review comment suggests optimizing isValidHostSyntax to avoid heap allocations and iterator overhead on the hot path by validating the host in a single pass.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Multi trailing-dot authorities normalize to empty labels and are now correctly rejected by isValidHostSyntax, so the regression case is updated to expect rejection instead of acceptance. Rewrite isValidHostSyntax as a single-pass, zero-allocation label scan (net.ParseIP only for IPv6 literals) per review feedback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

codecov · 2026-06-10T19:57:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.39%. Comparing base (5c141a1) to head (3cf7534).
⚠️ Report is 80 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4408      +/-   ##
==========================================
+ Coverage   91.33%   91.39%   +0.06%     
==========================================
  Files         132      133       +1     
  Lines       13193    13357     +164     
==========================================
+ Hits        12050    12208     +158     
- Misses        724      730       +6     
  Partials      419      419

Flag	Coverage Δ
unittests	`91.39% <100.00%> (+0.06%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Add a direct table test exercising empty host, IPv4/IPv6 literals, leading/trailing hyphen labels, empty labels, underscores and oversize labels, bringing isValidHostSyntax to 100% coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

🐛 bug: reject malformed hostnames in hostauthorization wildcard path

6d4d2e1

gaby requested a review from a team as a code owner June 6, 2026 11:59

gaby added aardvark codex labels Jun 6, 2026 — with ChatGPT Codex Connector

gaby requested review from ReneWerner87, efectn and sixcolors June 6, 2026 11:59

ReneWerner87 added v3 ☢️ Bug labels Jun 6, 2026

ReneWerner87 added this to v3 Jun 6, 2026

ReneWerner87 added this to the v3 milestone Jun 6, 2026

gaby removed the aardvark label Jun 6, 2026

gemini-code-assist Bot reviewed Jun 6, 2026

View reviewed changes

Comment thread middleware/hostauthorization/hostauthorization.go

gaby and others added 2 commits June 6, 2026 08:02

Merge branch 'main' into fix-wildcard-host-authorization-vulnerability

588163f

ReneWerner87 approved these changes Jun 10, 2026

View reviewed changes

ReneWerner87 merged commit df8b407 into main Jun 10, 2026
20 checks passed

ReneWerner87 deleted the fix-wildcard-host-authorization-vulnerability branch June 10, 2026 20:12

github-project-automation Bot moved this to Done in v3 Jun 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🐛 bug: reject malformed hostnames in hostauthorization wildcard path#4408

🐛 bug: reject malformed hostnames in hostauthorization wildcard path#4408
ReneWerner87 merged 4 commits into
mainfrom
fix-wildcard-host-authorization-vulnerability

gaby commented Jun 6, 2026

Uh oh!

coderabbitai Bot commented Jun 6, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gaby commented Jun 6, 2026

Motivation

Description

Testing

Uh oh!

coderabbitai Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

codecov Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 6, 2026 •

edited

Loading

codecov Bot commented Jun 10, 2026 •

edited

Loading