Add web_allow_hosts to the config

[codymoorhouse]

What is in this PR?

As part of the latest version of ngrok (changelog) a new configuration was added and enforced.

Added DNS rebinding protection which includes web_allow_hosts configuration.

This PR adds an allow_hosts option so that other web hostnames can be used to inspect the tunnel.

Before

After

QA

Can test this by manually copy and pasting the changes into: /Users/{USERNAME}/.rvm/gems/ruby-2.7.6/bundler/gems/ngrok-tunnel-c2bf7ddea04a/lib/ngrok/tunnel.rb and then booting up the ngrok server. Then add localhost.test into a allow_hosts key when spinning up (starting) the tunnel

• The ngrok inspect tool loads successfully for localhost.test

[codymoorhouse]

Hey @jcw- (permissions are pretty limited here, couldn't assign you and had to fork the repo to make this PR). But the PR is ready, not a huge change or anything, let me know if you have any questions!

[jcw-]

Thanks for digging into this @codymoorhouse!

I believe the pattern here is to make an empty config file to force ngrok to stop looking for any real ones that might be present on the user's system, and then to control the config entirely via the options setup in ngrok_exec_params. So I think ideally we would add this new config there, if possible?

[codymoorhouse]

Thanks for digging into this @codymoorhouse!

I believe the pattern here is to make an empty config file to force ngrok to stop looking for any real ones that might be present on the user's system, and then to control the config entirely via the options setup in ngrok_exec_params. So I think ideally we would add this new config there, if possible?

Ah yes, didn't even consider that and that does make sense. Unfortunately I just checked the available flags and I don't see one we could leverage for this specific configuration, so I think for the time we are stuck with the config file approach 😞

[codymoorhouse]

Hey @jcw- just wondering if there are any other changes you might need/foresee here. Was hoping to merge in the other PR in our other repo, but it won't have any affect until this is deployed and packaged up

[jcw-]

sorry for the extended delay on this one @codymoorhouse - at this point, I'm going to see if Dev Accel can pick this one up!