DNS rebinding means you shouldn't allow untrusted domains to resolve to a localhost IP address...