SafeRequest PATTERN_HOST_NAME fails for a.foo.com

GoogleCodeExporter commented 9 years ago

What steps will reproduce the problem?
1. set your hostname = 'www.a.foo.com'
2. invoke SafeRequest.getServerName()

What is the expected output? 
No output. It should return the server name successfully.

What do you see instead?
WARNING IntrusionDetector SECURITY-FAILURE UnknownLocalHost:443 
AnonymousUser@10.101.133.203[ID:295] HTTP Request Server Name validation&#x3a; 
Invalid input. Input does not conform to the whitelist regex 
&#x28;&#x5e;&#x28;&#x3f;&#x3a;&#x28;&#x3f;&#x3a;25&#x5b;0-5&#x5d;&#x7c;2&#x5b;0-
4&#x5d;&#x5b;0-9&#x5d;&#x7c;&#x5b;01&#x5d;&#x3f;&#x5b;0-9&#x5d;&#x5b;0-9&#x5d;&#
x3f;&#x29;&#x5c;.&#x29;&#x7b;3&#x7d;&#x28;&#x3f;&#x3a;25&#x5b;0-5&#x5d;&#x7c;2&#
x5b;0-4&#x5d;&#x5b;0-9&#x5d;&#x7c;&#x5b;01&#x5d;&#x3f;&#x5b;0-9&#x5d;&#x5b;0-9&#
x5d;&#x3f;&#x29;&#x24;&#x7c;&#x5e;&#x28;&#x28;&#x3f;&#x3a;&#x28;&#x3f;&#x3a;&#x5
b;0-9a-zA-Z&#x5d;&#x5b;0-9a-zA-Z&#x5c;-&#x5d;&#x7b;0,61&#x7d;&#x5b;0-9a-zA-Z&#x5
d;&#x29;&#x5c;.&#x29;&#x2a;&#x5b;a-zA-Z&#x5d;&#x7b;2,4&#x7d;&#x7c;&#x5b;0-9a-zA-
Z&#x5d;&#x5b;0-9a-zA-Z&#x5c;-&#x5d;&#x7b;0,61&#x7d;&#x5b;0-9a-zA-Z&#x5d;&#x29;&#
x24;&#x29; (This log message was encoded for HTML) exception 
'ValidationException' with message 'HTTP Re

What version of the product are you using? On what operating system?
r824 on FreeBSD

Please provide any additional information below.
I think the regex for PATTERN_HOST_NAME is not correct because it
is expecting at least 2 chars token seperated by the dot '.'

From 
http://www.ietf.org/rfc/rfc1035.txt

Section 2.3.1 

"They [hostnames] must
start with a letter, end with a letter or digit, and have as interior
characters only letters, digits, and hyphen.  There are also some
restrictions on the length.  Labels must be 63 characters or less."

Original issue reported on code.google.com by wwq...@gmail.com on 24 Mar 2011 at 4:13

GoogleCodeExporter commented 9 years ago

Taken

Original comment by vande...@gmail.com on 17 Jun 2011 at 3:34

Changed state: Accepted
Added labels: Milestone-Release1.0

GoogleCodeExporter commented 9 years ago

All these issues must be dealt with before 1.0. New issues will be on a case by 
case basis as to whether we hold up 1.0 or not.

Original comment by vande...@gmail.com on 17 Jun 2011 at 3:36

GoogleCodeExporter commented 9 years ago

Original comment by vande...@gmail.com on 17 Jun 2011 at 4:23

qbdsoft / owasp-esapi-php

SafeRequest PATTERN_HOST_NAME fails for a.foo.com #45