Hello! Our system/network admins scanned our local network and found on my computer strange proxy :)
telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. GET http://www.zope.org/ HTTP/1.0 Host: localhost
Then Zope returned root page of localhost, not www.zope.org, so it is not security hole, but anyway I think ZServer should not accept server name in he request. Instead an error (perhaps HTTP error 400) should be returned. Should I report this to Collector? Oleg. ---- Oleg Broytmann http://www.zope.org/Members/phd/ phd@phd.pp.ru Programmers don't die, they just GOSUB without RETURN.
On Sunday 11 March 2001 04:25, Oleg Broytmann wrote:
Hello!
Our system/network admins scanned our local network and found on my computer strange proxy :)
telnet localhost 8080
Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. GET http://www.zope.org/ HTTP/1.0 Host: localhost
Then Zope returned root page of localhost, not www.zope.org, so it is not security hole, but anyway I think ZServer should not accept server name in he request. Instead an error (perhaps HTTP error 400) should be returned. Should I report this to Collector?
probably as a feature request to z2.py for a check host option, else you'll be hosing those doing virtual hosting. kapil
The Http 1.1 spec REQUIRES that webservers accept canonical URLs in the request. The intent was to gradually move away from the 0.9/1.0 method of just sending the path, which can make things awkward when doing virtual hosting. What is not defined in the spec is what to do if you receive a request for a canonical url that does not exist on the server. It is totally appropriate for Zope to do what it did, and I don't think it should be changed. Certainly, nothing more than treating a request for a hostname that is not served locally as an error. --sam Oleg Broytmann wrote:
Hello!
Our system/network admins scanned our local network and found on my computer strange proxy :)
telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. GET http://www.zope.org/ HTTP/1.0 Host: localhost
Then Zope returned root page of localhost, not www.zope.org, so it is not security hole, but anyway I think ZServer should not accept server name in he request. Instead an error (perhaps HTTP error 400) should be returned. Should I report this to Collector?
Oleg. ---- Oleg Broytmann http://www.zope.org/Members/phd/ phd@phd.pp.ru Programmers don't die, they just GOSUB without RETURN.
_______________________________________________ Zope maillist - Zope@zope.org http://lists.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope-dev )
-- ------------------------------------------------ "I'll do the stupid thing first and then you shy people follow..." --Frank Zappa
participants (3)
-
ender -
Oleg Broytmann -
sam gendler