Drupal 7 only limits the length of the host name to 1000 bytes to prevent DoS attacks, and it doesn't accepts host names containing slashes, but it doesn't restrict the allowed host names basing on a value set in the settings.php file, as Drupal 8 and Drupal 9 do.
The code checking the value of the HTTP_HOST header is contained in drupal_valid_http_host().
// Limit the length of the host name to 1000 bytes to prevent DoS attacks with
// long host names.
return strlen($host) <= 1000 && substr_count($host, '.') <= 100 && substr_count($host, ':') <= 100 && preg_match('/^\\[?(?:[a-zA-Z0-9-:\\]_]+\\.?)+$/', $host);
The function is called by drupal_environment_initialize().
if (!isset($_SERVER['HTTP_REFERER'])) {
$_SERVER['HTTP_REFERER'] = '';
}
if (!isset($_SERVER['SERVER_PROTOCOL']) || $_SERVER['SERVER_PROTOCOL'] != 'HTTP/1.0' && $_SERVER['SERVER_PROTOCOL'] != 'HTTP/1.1') {
$_SERVER['SERVER_PROTOCOL'] = 'HTTP/1.0';
}
if (isset($_SERVER['HTTP_HOST'])) {
// As HTTP_HOST is user input, ensure it only contains characters allowed
// in hostnames. See RFC 952 (and RFC 2181).
// $_SERVER['HTTP_HOST'] is lowercased here per specifications.
$_SERVER['HTTP_HOST'] = strtolower($_SERVER['HTTP_HOST']);
if (!drupal_valid_http_host($_SERVER['HTTP_HOST'])) {
// HTTP_HOST is invalid, e.g. if containing slashes it may be an attack.
header($_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request');
exit;
}
}
else {
// Some pre-HTTP/1.1 clients will not send a Host header. Ensure the key is
// defined for E_ALL compliance.
$_SERVER['HTTP_HOST'] = '';
}
There is a patch that should add to Drupal 7 the same code used by Drupal 8, in HTTP_HOST header cannot be trusted. At the moment, the development of Drupal 7 slowed down, especially since when Drupal 8 and Drupal 9 has been developed at the same time.
Since that is considered a security improvement (with, apparently, low chances to happen to be considered a security issue, or the issue would not be discussed publicly), you could apply the patch provided in that issue (the latest one is, at the moment I posted this answer, https://www.drupal.org/files/issues/2021-02-04/http_host_header_cannot_bet_trusted-2221699-151.patch) and start using $conf['trusted_host_patterns'].
