TYPO3 Core

Danilo Godec wrote:

Wouter Wolters wrote:

The "trustedHostsPattern" configuration option can contain either the value SERVER_NAME or a regular expression pattern that matches all host names that are considered trustworthy for the particular TYPO3 installation. "SERVER_NAME" is the default value and with this option value in effect, TYPO3 checks the currently submitted host-header against the SERVER_NAME variable. Please see security bulletin TYPO3-CORE-SA-2014-001 (https://typo3.org/security/advisory/typo3-core-sa-2014-001/) for further details about specific setups.

Apparently the trailing dot is a valid part of fully-qualified DNS domain name (http://www.dns-sd.org/trailingdotsindomainnames.html), so wouldn't it make sense for Typo3 / "SERVER_NAME" to consider these valid as well?

http://www.example.com/ and http://www.example.com./ should both work even if it's Typo3...

I agree with you @Danilo Godec.

Thanks for your thoughts.

I think the 'ends with dot is identical to does-not-end-with-dot' scenario is a pretty theoretical scenario without much practical use. The fact that this is allowed per-RFC is probably very widely unknown. I'd go so far to assume the 'bot' you're mentioning above could be some malicious test script that checks systems for possible sec issues in this area, at least I wouldn't be baffled if it turns out to be like that.

I guess for your customers it has zero benefit if we add the dot at the end to match, too. Thus, I'd rate this issue very low without any priority, that's more a nerdy detail to me.

Maybe you have a similar view on this. Feel free to propose a change in this area if this has practical use for you, though.

Christian Kuhn wrote:

Thanks for your thoughts.

I think the 'ends with dot is identical to does-not-end-with-dot' scenario is a pretty theoretical scenario without much practical use.

After upgrading from Typo3 6 to Typo3 8 we started noticing PHP errors regarding 'trustedHostsPattern' and upon investigation we discovered that some people link to our site with the trailing dot. I don't know if these errors were present before and unfortunately, I can't check anymore.

Our first reaction was "let's just ignore this, it's their mistake", but apparently it should work.

Just in case anyone's interested - we implemented a workaround with Apache mod_rewrite:

RewriteCond ^(.+?)\.$
RewriteRule ^ %{REQUEST_SCHEME}://%1{REQUEST_URI} [L,R=302,NE]