Skip to content

[Request] Host fallback paths do not normalize malformed SERVER_NAME values with an embedded port #331

Description

@RedZapdos123

Description:

When HTTP_HOST is missing and SERVER_NAME already contains :port, Rage does not normalize the fallback host value before using it in request-host code paths.

This is an edge case Rack env, but it currently breaks multiple host-based paths on latest main.

MRE:

require "domain_name"
require "./lib/rage/all"

request_env = {
  "REQUEST_METHOD" => "GET",
  "rack.url_scheme" => "http",
  "PATH_INFO" => "/",
  "QUERY_STRING" => "",
  "rack.input" => StringIO.new,
  "SERVER_NAME" => "google.com:3000",
  "SERVER_PORT" => "3000"
}

request = Rage::Request.new(request_env)
puts "request.host => #{request.host.inspect}"
puts "request.url => #{request.url.inspect}"
puts "request.domain => #{request.domain.inspect}"

router = Rage::Router::Backend.new
router.on("GET", "/photos", ->(_) { "get photos" }, constraints: { host: "google.com" })
route_env = request_env.merge("PATH_INFO" => "/photos")
handler = router.lookup(route_env)
puts "router.lookup => #{handler.inspect}"

cookie_env = request_env.merge("SERVER_NAME" => "cookie.test.com:3000")
headers = {}

begin
  cookies = Rage::Cookies.new(cookie_env, headers)
  cookies[:x] = { value: 1, domain: :all }
  puts "cookies header => #{headers.inspect}"
rescue => e
  puts "cookies error => #{e.class}: #{e.message}"
end
Image

Current behavior:

  • request.host is nil.
  • request.url becomes "http://google.com:3000:3000/".
  • request.domain is nil.
  • exact host constraints do not match because router.lookup returns nil.
  • cookie domain resolution can raise TypeError: NilClass is not a String when domain: :all is used.

Actual output:

request.host => nil
request.url => "http://google.com:3000:3000/"
request.domain => nil
router.lookup => nil
cookies error => TypeError: NilClass is not a String

Expected behavior:

  • Rage should normalize the fallback host the same way it normalizes HTTP_HOST, even if SERVER_NAME is malformed and already includes a port.
  • request.host should be "google.com".
  • request.url should be "http://google.com:3000/".
  • request.domain should be "google.com".
  • exact host constraints for "google.com" should still match.
  • cookie domain resolution should derive from "cookie.test.com" instead of raising.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions