Function host_is_loopback

src/ui/http_server.c:1628–1632

True when the Host header names the loopback interface the server binds to * (with or without a port). Anything else means the request reached us under a * name that is not loopback — a rebinding DNS host or a proxy pointed at the * local port — which is the DNS-rebinding / cross-site vector against a * localhost-only service. */

 * local port — which is the DNS-rebinding / cross-site vector against a
 * localhost-only service. */
static bool host_is_loopback(const char *host) {
    return cbm_http_path_match(host, "localhost") || cbm_http_path_match(host, "localhost:*") ||
           cbm_http_path_match(host, "127.0.0.1") || cbm_http_path_match(host, "127.0.0.1:*") ||
           cbm_http_path_match(host, "[::1]") || cbm_http_path_match(host, "[::1]:*");
}

static void dispatch_request(cbm_http_server_t *srv, cbm_http_conn_t *c,
                             const cbm_http_req_t *req) {