Skip to content

fix(ssr): allow underscores in host validation#32846

Merged
alan-agius4 merged 1 commit intoangular:mainfrom
alan-agius4:add-host-validate
Mar 27, 2026
Merged

fix(ssr): allow underscores in host validation#32846
alan-agius4 merged 1 commit intoangular:mainfrom
alan-agius4:add-host-validate

Conversation

@alan-agius4
Copy link
Copy Markdown
Collaborator

The VALID_HOST_REGEX has been updated to include the underscore character. This ensures that hostnames containing underscores (e.g., in some internal or development environments) are correctly validated instead of being rejected.

Closes #32835

@alan-agius4 alan-agius4 requested a review from clydin March 26, 2026 10:48
@alan-agius4 alan-agius4 added action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release labels Mar 26, 2026
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the VALID_HOST_REGEX to include underscores, enhancing its flexibility for hostname validation. The review feedback suggests a further improvement to make the regex more robust by explicitly validating an optional port and preventing invalid host formats with multiple colons.

The VALID_HOST_REGEX has been updated to include the underscore
character. This ensures that hostnames containing underscores (e.g., in
some internal or development environments) are correctly validated
instead of being rejected.

Closes angular#32835
@alan-agius4 alan-agius4 requested review from dgp1130 and removed request for clydin March 26, 2026 21:20
* Regular expression to validate that the host is a valid hostname.
*/
const VALID_HOST_REGEX = /^[a-z0-9.:-]+$/i;
const VALID_HOST_REGEX = /^[a-z0-9_.-]+(:[0-9]+)?$/i;
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: Can you start a hostname with a -, _, or .? Do we care to be that specific? Might be fine to allow at this layer even if it fails elsewhere.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, but this is more of checking for invalid characters.

@alan-agius4 alan-agius4 added action: merge The PR is ready for merge by the caretaker and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Mar 27, 2026
@alan-agius4 alan-agius4 merged commit e7e434c into angular:main Mar 27, 2026
36 checks passed
@alan-agius4 alan-agius4 deleted the add-host-validate branch March 27, 2026 07:23
@alan-agius4
Copy link
Copy Markdown
Collaborator Author

This PR was merged into the repository. The changes were merged into the following branches:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/ssr target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

allowedHosts doesn't allow for my-site_1.localhost type host.

2 participants