I'm currently working with an Express app and would like to know whether I would be able to escape the following suffix validation:
---SNIP---
const validsuffixes = ['sub2.sub1.maindomain.io'];
...
---SNIP---
----SNIP----
pathRewrite: {
'/host/mainapp/app/proxy': ''
},
router: (request) => {
const Host = req.headers['Express-Host'];
const HostUrl = `https://${Host}/`;
const HostUrlObject = new URL(HostUrl);
if (
validsuffixes.some((suffix) =>
HostUrlObject.host.endsWith(suffix)
)
) {
return HostUrl;
}
throw new Error('Invalid Host URL');
},
----SNIP----
My question is whether it would be possible to inject/escape (or even able to execute code) in the above snippet via a crafted Header ('Express-Host') payload, and would be managed to send the request to HostUrl ?
Appreciate the help, hope this does make sense.
Thanks