Add support for DNS rebinding protections #284
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,108 @@ | ||||||
| package io.modelcontextprotocol.server.transport; | ||||||
|
|
||||||
| import java.util.Collections; | ||||||
| import java.util.HashSet; | ||||||
| import java.util.Set; | ||||||
|
|
||||||
| /** | ||||||
| * Configuration for DNS rebinding protection in SSE server transports. Provides | ||||||
| * validation for Host and Origin headers to prevent DNS rebinding attacks. | ||||||
| */ | ||||||
| public class DnsRebindingProtectionConfig { | ||||||
|
There was a problem hiding this comment.
|
||||||
|
|
||||||
| private final Set<String> allowedHosts; | ||||||
|
|
||||||
| private final Set<String> allowedOrigins; | ||||||
|
|
||||||
| private final boolean enableDnsRebindingProtection; | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| private DnsRebindingProtectionConfig(Builder builder) { | ||||||
|
There was a problem hiding this comment. Consider passing explicit arguments instead of the |
||||||
| this.allowedHosts = Collections.unmodifiableSet(new HashSet<>(builder.allowedHosts)); | ||||||
| this.allowedOrigins = Collections.unmodifiableSet(new HashSet<>(builder.allowedOrigins)); | ||||||
| this.enableDnsRebindingProtection = builder.enableDnsRebindingProtection; | ||||||
| } | ||||||
|
|
||||||
| /** | ||||||
| * Validates Host and Origin headers for DNS rebinding protection. Returns true if the | ||||||
| * headers are valid, false otherwise. | ||||||
| * @param hostHeader The value of the Host header (may be null) | ||||||
| * @param originHeader The value of the Origin header (may be null) | ||||||
| * @return true if the headers are valid, false otherwise | ||||||
| */ | ||||||
| public boolean validate(String hostHeader, String originHeader) { | ||||||
|
There was a problem hiding this comment.
Suggested change
There was a problem hiding this comment. I would expect a |
||||||
| // Skip validation if protection is not enabled | ||||||
| if (!enableDnsRebindingProtection) { | ||||||
| return true; | ||||||
| } | ||||||
|
|
||||||
| // Validate Host header | ||||||
| if (hostHeader != null) { | ||||||
| String lowerHost = hostHeader.toLowerCase(); | ||||||
| if (!allowedHosts.contains(lowerHost)) { | ||||||
| return false; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| // Validate Origin header | ||||||
| if (originHeader != null) { | ||||||
| String lowerOrigin = originHeader.toLowerCase(); | ||||||
| if (!allowedOrigins.contains(lowerOrigin)) { | ||||||
| return false; | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| return true; | ||||||
| } | ||||||
|
|
||||||
| public static Builder builder() { | ||||||
|
|
||||||
| return new Builder(); | ||||||
| } | ||||||
|
|
||||||
| public static class Builder { | ||||||
|
There was a problem hiding this comment. In order to avoid having two means to instantiate the There was a problem hiding this comment. Please add javadocs to the public class and its methods. |
||||||
|
|
||||||
| private final Set<String> allowedHosts = new HashSet<>(); | ||||||
|
|
||||||
| private final Set<String> allowedOrigins = new HashSet<>(); | ||||||
|
|
||||||
| private boolean enableDnsRebindingProtection = true; | ||||||
|
There was a problem hiding this comment. This ought to be documented in the builder and I believe it should also be the default value in the actual config class. |
||||||
|
|
||||||
| public Builder allowedHost(String host) { | ||||||
| if (host != null) { | ||||||
| this.allowedHosts.add(host.toLowerCase()); | ||||||
| } | ||||||
| return this; | ||||||
| } | ||||||
|
|
||||||
| public Builder allowedHosts(Set<String> hosts) { | ||||||
| if (hosts != null) { | ||||||
| hosts.forEach(this::allowedHost); | ||||||
| } | ||||||
| return this; | ||||||
| } | ||||||
|
|
||||||
| public Builder allowedOrigin(String origin) { | ||||||
| if (origin != null) { | ||||||
| this.allowedOrigins.add(origin.toLowerCase()); | ||||||
| } | ||||||
| return this; | ||||||
| } | ||||||
|
|
||||||
| public Builder allowedOrigins(Set<String> origins) { | ||||||
| if (origins != null) { | ||||||
| origins.forEach(this::allowedOrigin); | ||||||
| } | ||||||
| return this; | ||||||
| } | ||||||
|
|
||||||
| public Builder enableDnsRebindingProtection(boolean enable) { | ||||||
|
There was a problem hiding this comment. This method name is useful, but internally the field can be just named |
||||||
| this.enableDnsRebindingProtection = enable; | ||||||
| return this; | ||||||
| } | ||||||
|
|
||||||
| public DnsRebindingProtectionConfig build() { | ||||||
| return new DnsRebindingProtectionConfig(this); | ||||||
| } | ||||||
|
|
||||||
| } | ||||||
|
|
||||||
| } | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The description should be setting some expectations as to how it can be used and when it will fail to validate and when it will succeed.