Affected: invenio-app

invenio-app before 1.1.1 allows host header injection.

Affected: PyPI: invenio-app

## APP_ALLOWED_HOSTS not always preventing host header injection

### Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met:

1. Your webserver must have been configured to route all requests to your application. 2. You must have relied on ``APP_ALLOWED_HOSTS`` configuration variable to whitelist allowed host headers. 3. Flask's ``request.host`` must not have been evaluated during request handling.

An example of a view which does not evalute ``request.host`` is a simple view using just ``url_for`` to generate an external URL (similar is possible when rendering just a Jinja template):

```python @app.route('/') def index(): return url_for('index_url', _external=True) ```

This happens, because Werkzeug's trusted host feature, which ``APP_ALLOWED_HOSTS`` rely on, does not check the the list of trusted hosts in it's routing system that ``url_for`` is relying on.

### Patches Invenio-App v1.0.6 and v1.1.1 fully fix the issue.

Note, we strongly recommend (see [Securing your instance](https://invenio.readthedocs.io/en/latest/deployment/securing-your-instance.html#allowed-hosts)) that you never route requests to your application with a wrong host header. The ``APP_ALLOWED_HOSTS`` configuration variable exists as an extra protective measure because it is easy to misconfigure your web server to allow requests with any host header.

### Workaround 1 - Configure your webserver

You s…