Add check for Host Authorization middleware

The Host Authorization middleware protects against DNS rebinding.
This middleware is primarily targeted at the development environment:

> It is included in the development environment by default ... In other
environments Rails.application.config.hosts is empty and no Host header
checks will be done.
rails/rails#33145

If someone decides to call `config.hosts.clear` because it's "only
development", we should warn them they are vulnerable to DNS rebinding.

Author: p8

lib/brakeman/checks/check_hosts.rb

@@ -0,0 +1,27 @@
+class Brakeman::CheckHosts < Brakeman::BaseCheck
+  Brakeman::Checks.add_optional self
+
+  @description = "Check that hosts setting is not empty in development"
+
+  def run_check
+    return if tracker.config.rails.empty? or tracker.config.rails_version.nil?
+    return if tracker.config.rails_version < "6"
+
+    hosts = tracker.config.rails[:hosts]
+
+    if hosts.nil? || hosts.empty?
+      line = if sexp? hosts
+               hosts.line
+             else
+               1
+             end
+
+      warn :warning_type => "DNS rebinding",
+        :warning_code => :hosts_empty,
+        :message => msg("The application does not guard against DNS rebinding: ", msg_code("config.hosts"), " is empty"),
+        :confidence => :high,
+        :file => "config/environments/development.rb",
+        :line => line
+    end
+  end
+end

lib/brakeman/warning_codes.rb

@@ -121,6 +121,7 @@ module Brakeman::WarningCodes
     :erb_template_injection => 117,
     :http_verb_confusion => 118,
     :unsafe_method_reflection => 119,
+    :hosts_empty => 120,
 
     :custom_check => 9090,
   }

test/tests/rails5.rb

@@ -12,7 +12,7 @@ def expected
     @@expected ||= {
       :controller => 0,
       :model => 0,
-      :template => 19,
+      :template => 20,
       :generic => 24
     }
   end

test/tests/rails6.rb

@@ -13,7 +13,7 @@ def expected
       :controller => 0,
       :model => 0,
       :template => 4,
-      :generic => 34
+      :generic => 35
     }
   end
 
@@ -332,6 +332,19 @@ def test_cross_site_scripting_4
       :user_input => nil
   end
 
+  def test_dns_rebinding_config
+    assert_warning :type => :warning,
+      :warning_code => 120,
+      :fingerprint => "34dfccb87369f7f659bb31070c4d33ccf06d5d1a45e0402a518ddfd25cfe7a9b",
+      :warning_type => "DNS rebinding",
+      :line => 1,
+      :message => /^The\ application\ does\ not\ guard\ against/,
+      :confidence => 0,
+      :relative_path => "config/environments/development.rb",
+      :code => nil,
+      :user_input => nil
+  end
+
   def test_cross_site_scripting_json_escape_config
     assert_warning :type => :warning,
       :warning_code => 113,