Restrict DNS Allowlist authorization to index site only.

Otherwise, an undesired degree of freedom permits a third party to
deny access to index site URLs by publishing projects with the same
name.

In the future, the _git-pages-repository TXT record format may be
extended to allow non-index sites to be specified without introducing
undesired degrees of freedom.

src/auth.go

@@ -159,6 +159,11 @@ func authorizeDNSAllowlist(r *http.Request) (*Authorization, error) {
 		return nil, err
 	}
 
+	projectName, err := GetProjectName(r)
+	if err != nil {
+		return nil, err
+	}
+
 	allowlistHostname := fmt.Sprintf("_git-pages-repository.%s", host)
 	records, err := net.LookupTXT(allowlistHostname)
 	if err != nil {
@@ -166,6 +171,11 @@ func authorizeDNSAllowlist(r *http.Request) (*Authorization, error) {
 			fmt.Sprintf("failed to look up DNS repository allowlist: %s TXT", allowlistHostname)}
 	}
 
+	if projectName != ".index" {
+		return nil, AuthError{http.StatusUnauthorized,
+			"DNS repository allowlist only authorizes index site"}
+	}
+
 	var (
 		repoURLs []string
 		errs     []error