{"action":"created","issue":{"url":"https://api.github.com/repos/vulcand/vulcand/issues/221","repository_url":"https://api.github.com/repos/vulcand/vulcand","labels_url":"https://api.github.com/repos/vulcand/vulcand/issues/221/labels{/name}","comments_url":"https://api.github.com/repos/vulcand/vulcand/issues/221/comments","events_url":"https://api.github.com/repos/vulcand/vulcand/issues/221/events","html_url":"https://github.com/vulcand/vulcand/issues/221","id":92339819,"number":221,"title":"X-Forwarded-Host gets mangled","user":{"login":"fracklen","id":2706577,"avatar_url":"https://avatars.githubusercontent.com/u/2706577?v=3","gravatar_id":"","url":"https://api.github.com/users/fracklen","html_url":"https://github.com/fracklen","followers_url":"https://api.github.com/users/fracklen/followers","following_url":"https://api.github.com/users/fracklen/following{/other_user}","gists_url":"https://api.github.com/users/fracklen/gists{/gist_id}","starred_url":"https://api.github.com/users/fracklen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fracklen/subscriptions","organizations_url":"https://api.github.com/users/fracklen/orgs","repos_url":"https://api.github.com/users/fracklen/repos","events_url":"https://api.github.com/users/fracklen/events{/privacy}","received_events_url":"https://api.github.com/users/fracklen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-07-01T10:20:24Z","updated_at":"2016-11-07T13:11:55Z","closed_at":null,"body":"I have a setup, where I need a proxy in front of Vulcand. This proxy handles forward-headers, and rewrites the Host header before vulcand sees the request.\n\nI would expect vulcand to leave the `X-Forwarded-*`-headers alone, if the `TrustForwardedHeader` option is enabled\n\nI've made a pull-request in oxy https://github.com/mailgun/oxy/pull/19\n"},"comment":{"url":"https://api.github.com/repos/vulcand/vulcand/issues/comments/258831581","html_url":"https://github.com/vulcand/vulcand/issues/221#issuecomment-258831581","issue_url":"https://api.github.com/repos/vulcand/vulcand/issues/221","id":258831581,"user":{"login":"McSlow","id":1178921,"avatar_url":"https://avatars.githubusercontent.com/u/1178921?v=3","gravatar_id":"","url":"https://api.github.com/users/McSlow","html_url":"https://github.com/McSlow","followers_url":"https://api.github.com/users/McSlow/followers","following_url":"https://api.github.com/users/McSlow/following{/other_user}","gists_url":"https://api.github.com/users/McSlow/gists{/gist_id}","starred_url":"https://api.github.com/users/McSlow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/McSlow/subscriptions","organizations_url":"https://api.github.com/users/McSlow/orgs","repos_url":"https://api.github.com/users/McSlow/repos","events_url":"https://api.github.com/users/McSlow/events{/privacy}","received_events_url":"https://api.github.com/users/McSlow/received_events","type":"User","site_admin":false},"created_at":"2016-11-07T13:11:55Z","updated_at":"2016-11-07T13:11:55Z","body":"Merging introduces serious XSS issues if the backend trusts the content of X-Forward-For and displays it or puts it into some database:\r\n\r\nHere a case where I add an X-Forward-For-Header in my client(!)\r\n```\r\nopenssl s_connect --connect showmyip.domain.com:443\r\nGET / HTTP/1.0\r\nHost: showmyip.domain.com\r\nX-Forwarded-For: <html><script>alert(\"Hello from the XSS Guys\");</script></html>\r\n\r\nHTTP/1.0 200 OK\r\nContent-Length: 58\r\nContent-Type: text/html; charset=utf-8\r\nDate: Mon, 07 Nov 2016 11:54:33 GMT\r\n\r\n<html><script>alert(\"Hello from the XSS Guys\");</script></html>, 78.47.220.83closed \r\n```\r\n\r\nOf course, an app should never trust any input parameter, but I guess there's a lot of out there in the wild...\r\n\r\n"}}
{"actor":{"display_login":"McSlow"}}