Merge pull request #1833 from itowlson/report-blocked-http-hosts

Always print warning on blocked outbound HTTP
fermyon · Oct 3, 2023 · b4c54ca · b4c54ca
2 parents 179f78c + ac4d6c6
commit b4c54ca
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/outbound-http/Cargo.toml b/crates/outbound-http/Cargo.toml
@@ -14,5 +14,6 @@ reqwest = { version = "0.11", features = ["gzip"] }
 spin-app = { path = "../app" }
 spin-core = { path = "../core" }
 spin-world = { path = "../world" }
+terminal = { path = "../terminal" }
 tracing = { workspace = true }
 url = "2.2.1"
diff --git a/crates/outbound-http/src/lib.rs b/crates/outbound-http/src/lib.rs
@@ -53,6 +53,10 @@ impl outbound_http::Host for OutboundHttp {
                 .map_err(|_| HttpError::RuntimeError)?
             {
                 tracing::log::info!("Destination not allowed: {}", req.uri);
+                if let Some(host) = host(&req.uri) {
+                    terminal::warn!("A component tried to make a HTTP request to non-allowed host '{host}'.");
+                    eprintln!("To allow requests, add 'allowed_http_hosts = [\"{host}\"]' to the manifest component section.");
+                }
                 return Err(HttpError::DestinationNotAllowed);
             }
 
@@ -167,3 +171,9 @@ fn response_headers(h: &HeaderMap) -> anyhow::Result<Option<Vec<(String, String)
 
     Ok(Some(res))
 }
+
+fn host(url: &str) -> Option<String> {
+    url::Url::parse(url)
+        .ok()
+        .and_then(|u| u.host().map(|h| h.to_string()))
+}