@@ -0,0 +1,1131 @@
+import pytest%0Aimport requests%0A%0A%0Aclass TestRedirect:%0A%0A    @pytest.mark.parametrize(%0A        'path', ('/mesos_dns', '/net', '/exhibitor', '/mesos')%0A    )%0A    def test_redirect(self, master_ar_process, valid_user_header, path):%0A        %22%22%22%0A        URL's with no slash on end may redirect to the same URL with a%0A        slash appended. If this redirection uses the Host header to write%0A        the redirection, then it is susceptible to a client being tricked%0A        into setting the Host header to a bad host, and then redirecting%0A        the request (including an Authorization header) to the bad host.%0A        %22%22%22%0A        url = master_ar_process.make_url_from_path(path)%0A        headers = valid_user_header.copy()%0A        headers%5B'Host'%5D = 'bad.host'%0A        resp = requests.get(%0A            url,%0A            allow_redirects=False,%0A            headers=headers%0A            )%0A        resp.raise_for_status()%0A%0A        if resp.status_code in (301, 302, 303, 307):%0A            assert 'bad.host' not in resp.headers%5B'Location'%5D%0A            assert resp.headers%5B'Location'%5D == '//'%0A        else:%0A            assert resp.status_code == 200%0A

Add tests to demonstrate bad Host header problem