dapps-hosts configuration

parity/cli.rs

@@ -134,6 +134,11 @@ API and Console Options:
   --dapps-interface IP     Specify the hostname portion of the Dapps
                            server, IP should be an interface's IP address,
                            or local [default: local].
+  --dapps-hosts HOSTS      List of allowed Host header values. This option will
+                           validate the Host header sent by the browser, it
+                           is additional security against some attack
+                           vectors. Special options: "all", "none",
+                           [default: none].
   --dapps-user USERNAME    Specify username for Dapps server. It will be
                            used in HTTP Basic Authentication Scheme.
                            If --dapps-pass is not specified you will be
@@ -346,6 +351,7 @@ pub struct Args {
 	pub flag_no_dapps: bool,
 	pub flag_dapps_port: u16,
 	pub flag_dapps_interface: String,
+	pub flag_dapps_hosts: String,
 	pub flag_dapps_user: Option<String>,
 	pub flag_dapps_pass: Option<String>,
 	pub flag_dapps_path: String,

parity/configuration.rs

@@ -356,6 +356,7 @@ impl Configuration {
 			enabled: self.dapps_enabled(),
 			interface: self.dapps_interface(),
 			port: self.args.flag_dapps_port,
+			hosts: self.dapps_hosts(),
 			user: self.args.flag_dapps_user.clone(),
 			pass: self.args.flag_dapps_pass.clone(),
 			dapps_path: self.directories().dapps,
@@ -485,6 +486,16 @@ impl Configuration {
 		Some(hosts)
 	}
 
+	fn dapps_hosts(&self) -> Option<Vec<String>> {
+		match self.args.flag_dapps_hosts.as_ref() {
+			"none" => return Some(Vec::new()),
+			"all" => return None,
+			_ => {}
+		}
+		let hosts = self.args.flag_dapps_hosts.split(',').map(|h| h.into()).collect();
+		Some(hosts)
+	}
+
 	fn ipc_config(&self) -> Result<IpcConfiguration, String> {
 		let conf = IpcConfiguration {
 			enabled: !(self.args.flag_ipcdisable || self.args.flag_ipc_off || self.args.flag_no_ipc),
@@ -860,6 +871,23 @@ mod tests {
 		assert_eq!(conf3.rpc_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
 	}
 
+	#[test]
+	fn should_parse_dapps_hosts() {
+		// given
+
+		// when
+		let conf0 = parse(&["parity"]);
+		let conf1 = parse(&["parity", "--dapps-hosts", "none"]);
+		let conf2 = parse(&["parity", "--dapps-hosts", "all"]);
+		let conf3 = parse(&["parity", "--dapps-hosts", "ethcore.io,something.io"]);
+
+		// then
+		assert_eq!(conf0.dapps_hosts(), Some(Vec::new()));
+		assert_eq!(conf1.dapps_hosts(), Some(Vec::new()));
+		assert_eq!(conf2.dapps_hosts(), None);
+		assert_eq!(conf3.dapps_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
+	}
+
 	#[test]
 	fn should_disable_signer_in_geth_compat() {
 		// given

parity/dapps.rs

@@ -25,6 +25,7 @@ pub struct Configuration {
 	pub enabled: bool,
 	pub interface: String,
 	pub port: u16,
+	pub hosts: Option<Vec<String>>,
 	pub user: Option<String>,
 	pub pass: Option<String>,
 	pub dapps_path: String,
@@ -36,6 +37,7 @@ impl Default for Configuration {
 			enabled: true,
 			interface: "127.0.0.1".into(),
 			port: 8080,
+			hosts: Some(Vec::new()),
 			user: None,
 			pass: None,
 			dapps_path: replace_home("$HOME/.parity/dapps"),
@@ -68,7 +70,7 @@ pub fn new(configuration: Configuration, deps: Dependencies) -> Result<Option<We
 		(username.to_owned(), password)
 	});
 
-	Ok(Some(try!(setup_dapps_server(deps, configuration.dapps_path, &addr, auth))))
+	Ok(Some(try!(setup_dapps_server(deps, configuration.dapps_path, &addr, configuration.hosts, auth))))
 }
 
 pub use self::server::WebappServer;
@@ -84,6 +86,7 @@ mod server {
 		_deps: Dependencies,
 		_dapps_path: String,
 		_url: &SocketAddr,
+		_allowed_hosts: Option<Vec<String>>,
 		_auth: Option<(String, String)>,
 	) -> Result<WebappServer, String> {
 		Err("Your Parity version has been compiled without WebApps support.".into())
@@ -109,6 +112,7 @@ mod server {
 		deps: Dependencies,
 		dapps_path: String,
 		url: &SocketAddr,
+		allowed_hosts: Option<Vec<String>>,
 		auth: Option<(String, String)>
 	) -> Result<WebappServer, String> {
 		use ethcore_dapps as dapps;
@@ -119,10 +123,10 @@ mod server {
 		let server = rpc_apis::setup_rpc(server, deps.apis.clone(), rpc_apis::ApiSet::UnsafeContext);
 		let start_result = match auth {
 			None => {
-				server.start_unsecure_http(url)
+				server.start_unsecured_http(url, allowed_hosts)
 			},
 			Some((username, password)) => {
-				server.start_basic_auth_http(url, &username, &password)
+				server.start_basic_auth_http(url, allowed_hosts, &username, &password)
 			},
 		};