Merge pull request #3243 from mhils/dns-rebinding

mitmweb: protect against dns rebinding

mitmproxy/tools/web/app.py

@@ -463,10 +463,33 @@ class SaveOptions(RequestHandler):
         pass
 
 
+class DnsRebind(RequestHandler):
+    def get(self):
+        raise tornado.web.HTTPError(
+            403,
+            reason="To protect against DNS rebinding, mitmweb can only be accessed by IP at the moment. "
+                   "(https://github.com/mitmproxy/mitmproxy/issues/3234)"
+        )
+
+
 class Application(tornado.web.Application):
     def __init__(self, master, debug):
         self.master = master
-        handlers = [
+        super().__init__(
+            default_host="dns-rebind-protection",
+            template_path=os.path.join(os.path.dirname(__file__), "templates"),
+            static_path=os.path.join(os.path.dirname(__file__), "static"),
+            xsrf_cookies=True,
+            cookie_secret=os.urandom(256),
+            debug=debug,
+            autoreload=False,
+        )
+
+        self.add_handlers("dns-rebind-protection", [(r"/.*", DnsRebind)])
+        self.add_handlers(
+            # make mitmweb accessible by IP only to prevent DNS rebinding.
+            r'^(localhost|[0-9.:\[\]]+)$',
+            [
                 (r"/", IndexHandler),
                 (r"/filter-help(?:\.json)?", FilterHelp),
                 (r"/updates", ClientConnection),
@@ -490,12 +513,4 @@ class Application(tornado.web.Application):
                 (r"/options(?:\.json)?", Options),
                 (r"/options/save", SaveOptions)
             ]
-        settings = dict(
-            template_path=os.path.join(os.path.dirname(__file__), "templates"),
-            static_path=os.path.join(os.path.dirname(__file__), "static"),
-            xsrf_cookies=True,
-            cookie_secret=os.urandom(256),
-            debug=debug,
-            autoreload=False,
         )
-        super().__init__(handlers, **settings)