v0.33.8

src/config/snapshot.rs

@@ -392,14 +392,19 @@ pub fn normalize_host_pattern(value: &str) -> Result<String> {
 pub fn request_host(value: &str) -> Result<String> {
     ensure!(!value.contains('@'), "invalid Host");
     let authority: Authority = value.parse().context("invalid Host authority")?;
-    if let Some(port) = authority.port() {
-        let number: u16 = port.as_str().parse().context("invalid Host port")?;
-        ensure!(number > 0, "invalid Host port");
+    // Authority::port() returns None for both an absent and an invalid port.
+    // Inspect the explicit suffix so an out-of-range port cannot bypass validation.
+    let raw_host = authority.host();
+    let suffix = &authority.as_str()[raw_host.len()..];
+    if !suffix.is_empty() {
+        let port = suffix.strip_prefix(':').context("invalid Host port")?;
+        // HTTP permits an empty port suffix, which selects the default port.
+        if !port.is_empty() {
+            let number: u16 = port.parse().context("invalid Host port")?;
+            ensure!(number > 0, "invalid Host port");
+        }
     }
-    let host = authority
-        .host()
-        .trim_start_matches('[')
-        .trim_end_matches(']');
+    let host = raw_host.trim_start_matches('[').trim_end_matches(']');
     if let Ok(ip) = host.parse::<IpAddr>() {
         return Ok(ip.to_string());
     }