fix: return 400 if uri is bad

lib/rack/canonical_host.rb

@@ -20,6 +20,8 @@ def call(env)
       else
         redirect.response
       end
+    rescue Addressable::URI::InvalidURIError
+      [400, { Rack::CONTENT_TYPE => "text/plain", Rack::CONTENT_LENGTH => "0" }, []]
     end
 
   protected

spec/rack/canonical_host_spec.rb

@@ -98,6 +98,21 @@ def call_app
 
         it_behaves_like 'a non-matching request'
       end
+
+      context 'which is an invalid uri' do
+        let(:headers) { { 'HTTP_X_FORWARDED_HOST' => '[${jndi:ldap://172.16.26.190:52314/nessus}]/' } }
+
+        it { should_not be_redirect }
+
+        it { expect(response[0]).to be 400 }
+
+        it 'does not call the inner app' do
+          expect(inner_app).to_not receive(:call)
+          call_app
+        end
+
+        it { expect(response).to_not have_header('cache-control') }
+      end
     end
 
     context 'without a host' do