Harden against host header injection and open redirect (CVE-2025-50578)

[KodeStar]

Problem

Resolves #1451 (CVE-2025-50578).

Heimdall trusted attacker-controlled host headers for URL generation. layouts/app.blade.php renders <base href="{{ url('') }}"> (request-host-based) when APP_URL is left at its default, and views build absolute URLs with asset(). Because TrustProxies trusted X-Forwarded-Host over broad private proxy ranges, a request like:

GET / HTTP/1.1
Host: localhost
X-Forwarded-Host: evil.com

made every relative asset load from evil.com, and redirect(route('dash')) emitted a Location pointing at the spoofed host (the "open redirect").

Change (backward-compatible by default)

• Stop trusting X-Forwarded-Host in TrustProxies — a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For / -Port / -Proto handling is unchanged.
• TRUSTED_PROXIES env var — reverse-proxy IPs/CIDRs are now configurable (comma-separated, * to trust all), defaulting to the previous private ranges when unset.
• TRUSTED_HOSTS env var (opt-in) — a new App\Http\Middleware\TrustHosts restricts the Host header to a configured allow-list. Unset ⇒ no restriction (Heimdall keeps serving arbitrary hosts, so existing installs are unaffected). Set to your domain ⇒ any other Host is rejected (HTTP 400), fully closing the direct-Host-injection vector.

Installs that already set APP_URL were partially protected (Heimdall calls URL::forceRootUrl(config('app.url'))); this change closes the remaining header-trust gap and gives operators an explicit lockdown knob.

Tests

tests/Feature/TrustProxiesTest.php + tests/Feature/TrustHostsTest.php (12 tests): X-Forwarded-Host is ignored while X-Forwarded-Proto still works, TRUSTED_PROXIES parsing incl. *, TRUSTED_HOSTS empty ⇒ arbitrary host accepted, TRUSTED_HOSTS=example.com ⇒ evil.com rejected / example.com accepted, and the subclass is registered in the global middleware stack. Full suite green (46 passing, 1 pre-existing skip); phpcs clean.

Notes

• The TRUSTED_HOSTS allow-list follows Laravel's standard TrustHosts behaviour and only enforces when APP_ENV is not local. The X-Forwarded-Host change (the primary mitigation) applies in all environments.
• TRUSTED_PROXIES / TRUSTED_HOSTS are read via env(); if you run php artisan config:cache the defaults apply. The security-critical default (not trusting X-Forwarded-Host) is hard-coded and unaffected.