search

pallets / werkzeug

The comprehensive WSGI web application library.
https://werkzeug.palletsprojects.com
BSD 3-Clause "New" or "Revised" License
6.66k stars 1.74k forks source link

validate `request.trusted_hosts` in `Map.bind_to_environ` #3008

Open davidism opened 1 week ago

davidism commented 1 week ago

If a Request is passed to Map.bind_to_environ, access request.host to get the server name, which triggers validating request.trusted_hosts.

Built on top of #3006 fixes #3007