SilverStripe\Control\Middleware\AllowedHostsMiddleware

Complexity

Total Complexity

7

Size/Duplication

Total Lines	51
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	3

Importance

Changes

0

3 Methods

Rating	Name	Duplication	Size	Complexity
A	getAllowedHosts()	0	4	1
A	setAllowedHosts()	0	8	2
A	process()	0	14	4

<?php

namespace SilverStripe\Control\Middleware;

use SilverStripe\Control\Director;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Control\HTTPResponse;

/**
 * Secures requests by only allowing a whitelist of Host values
 */
class AllowedHostsMiddleware implements HTTPMiddleware
{
    /**
     * List of allowed hosts
     *
     * @var array
     */
    private $allowedHosts = [];

    /**
     * @return array List of allowed Host header values
     */
    public function getAllowedHosts()
    {
        return $this->allowedHosts;
    }

    /**
     * Sets the list of allowed Host header values
     * Can also specify a comma separated list
     *
     * @param array|string $allowedHosts
     * @return $this
     */
    public function setAllowedHosts($allowedHosts)
    {
        if (is_string($allowedHosts)) {
            $allowedHosts = preg_split('/ *, */', $allowedHosts);
        }
        $this->allowedHosts = $allowedHosts;
        return $this;
    }

    /**
     * @inheritdoc
     */
    public function process(HTTPRequest $request, callable $delegate)
    {
        $allowedHosts = $this->getAllowedHosts();

        // check allowed hosts
        if ($allowedHosts

The expression $allowedHosts of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

            && !Director::is_cli()
            && !in_array($request->getHeader('Host'), $allowedHosts)
        ) {
            return new HTTPResponse('Invalid Host', 400);
        }

        return $delegate($request);
    }
}