fix: validate Host header against allowlist before using in clone URL
A spoofed Host header could cause the server to render a clone URL pointing at an attacker-controlled domain. Guard against this by checking request.base_url.hostname against settings.allowed_hosts before using it; fall back to settings.public_url otherwise.
Allowlist is configurable via ALLOWED_HOSTS env var (JSON array). Defaults: musehub.ai, staging.musehub.ai, localhost:10003.
Regression test: ASGITransport client with Host: evil.com verifies the clone input value does not reflect the spoofed host.
sha256:f47218be5be5cc6cc5c22741eec8b0b5fe9eacd2a9786f6e8968af40294b6e5f
sha
sha256:14bef51df117c742d23c9ecb50c50bee82f2cbc73b6707b4124e8c4a34ea6bec
snapshot
0 comments
To add a comment, use the Muse CLI:
muse hub commit comment sha256:f47218be5be5cc6cc5c22741eec8b0b5fe9eacd2a9786f6e8968af40294b6e5f --body "your comment"
No comments yet. Be the first to start the discussion.