diff --git a/core/lib/Drupal/Core/DrupalKernel.php b/core/lib/Drupal/Core/DrupalKernel.php
index c014e4a..1dc897f 100644
--- a/core/lib/Drupal/Core/DrupalKernel.php
+++ b/core/lib/Drupal/Core/DrupalKernel.php
@@ -314,7 +314,10 @@ public static function findSitePath(Request $request, $require_settings = TRUE)
     if (!$script_name) {
       $script_name = $request->server->get('SCRIPT_FILENAME');
     }
-    $http_host = $request->server->get('HTTP_HOST');
+    $http_host = $request->getHost();
+    if (self::validateHostnameLength($http_host) == FALSE) {
+      throw new \UnexpectedValueException('Bad hostname');
+    }
 
     $sites = array();
     include DRUPAL_ROOT . '/sites/sites.php';
@@ -809,8 +812,7 @@ protected function initializeRequestGlobals(Request $request) {
     }
     else {
       // Create base URL.
-      $http_protocol = $request->isSecure() ? 'https' : 'http';
-      $base_root = $http_protocol . '://' . $request->server->get('HTTP_HOST');
+      $base_root = $request->getSchemeAndHttpHost();
 
       $base_url = $base_root;
 
@@ -892,9 +894,7 @@ protected function initializeCookieGlobals(Request $request) {
       // Replace "core" out of session_name so core scripts redirect properly,
       // specifically install.php.
       $session_name = preg_replace('/\/core$/', '', $session_name);
-      // HTTP_HOST can be modified by a visitor, but has been sanitized already
-      // in DrupalKernel::bootEnvironment().
-      if ($cookie_domain = $request->server->get('HTTP_HOST')) {
+      if ($cookie_domain = $request->getHost()) {
         // Strip leading periods, www., and port numbers from cookie domain.
         $cookie_domain = ltrim($cookie_domain, '.');
         if (strpos($cookie_domain, 'www.') === 0) {
@@ -1249,4 +1249,23 @@ protected function classLoaderAddMultiplePsr4(array $namespaces = array()) {
     }
   }
 
+  /**
+   * Validates a hostname length.
+   *
+   * @param string $host
+   *   A hostname.
+   *
+   * @return bool
+   *   TRUE if the length is appropriate, or FALSE otherwise.
+   */
+  protected static function validateHostnameLength($host) {
+    // Limit the length of the host name to 1000 bytes to prevent DoS attacks
+    // with long host names.
+    return strlen($host) <= 1000
+    // Limit the number of subdomains and port separators to prevent DoS attacks
+    // in findSitePath().
+    && substr_count($host, '.') <= 100
+    && substr_count($host, ':') <= 100;
+  }
+
 }
diff --git a/core/modules/field_ui/src/Form/FieldStorageEditForm.php b/core/modules/field_ui/src/Form/FieldStorageEditForm.php
index 5cd57b7..086a00c 100644
--- a/core/modules/field_ui/src/Form/FieldStorageEditForm.php
+++ b/core/modules/field_ui/src/Form/FieldStorageEditForm.php
@@ -98,18 +98,6 @@ public function buildForm(array $form, FormStateInterface $form_state, FieldConf
       $form['field_storage']['#prefix'] = '<div class="messages messages--error">' . $this->t('There is data for this field in the database. The field settings can no longer be changed.') . '</div>' . $form['field_storage']['#prefix'];
     }
 
-    // Add settings provided by the field module. The field module is
-    // responsible for not returning settings that cannot be changed if
-    // the field already has data.
-    $form['field_storage']['settings'] = array(
-      '#weight' => -10,
-    );
-    // Create an arbitrary entity object, so that we can have an instantiated
-    // FieldItem.
-    $ids = (object) array('entity_type' => $this->field->entity_type, 'bundle' => $this->field->bundle, 'entity_id' => NULL);
-    $entity = _field_create_entity_from_ids($ids);
-    $form['field_storage']['settings'] += $entity->get($field_storage->getName())->first()->storageSettingsForm($form, $form_state, $field_storage->hasData());
-
     // Build the configurable field values.
     $cardinality = $field_storage->getCardinality();
     $form['field_storage']['cardinality_container'] = array(
@@ -153,6 +141,18 @@ public function buildForm(array $form, FormStateInterface $form_state, FieldConf
     $form['field_storage']['module'] = array('#type' => 'value', '#value' => $field_storage->module);
     $form['field_storage']['translatable'] = array('#type' => 'value', '#value' => $field_storage->isTranslatable());
 
+    // Add settings provided by the field module. The field module is
+    // responsible for not returning settings that cannot be changed if
+    // the field already has data.
+    $form['field_storage']['settings'] = array(
+      '#weight' => 10,
+    );
+    // Create an arbitrary entity object, so that we can have an instantiated
+    // FieldItem.
+    $ids = (object) array('entity_type' => $this->field->entity_type, 'bundle' => $this->field->bundle, 'entity_id' => NULL);
+    $entity = _field_create_entity_from_ids($ids);
+    $form['field_storage']['settings'] += $entity->get($field_storage->getName())->first()->storageSettingsForm($form, $form_state, $field_storage->hasData());
+
     $form['actions'] = array('#type' => 'actions');
     $form['actions']['submit'] = array(
       '#type' => 'submit',
diff --git a/core/modules/shortcut/shortcut.module b/core/modules/shortcut/shortcut.module
index 601a149..a90b79e 100644
--- a/core/modules/shortcut/shortcut.module
+++ b/core/modules/shortcut/shortcut.module
@@ -298,7 +298,10 @@ function shortcut_preprocess_page(&$variables) {
   // pages).
   if (shortcut_set_edit_access()->isAllowed() && !\Drupal::request()->attributes->has('exception')) {
     $link = current_path();
-    $route_match = \Drupal::routeMatch();
+    if (!($url = \Drupal::pathValidator()->getUrlIfValid($link))) {
+      // Bail out early if we couldn't find a matching route.
+      return;
+    }
 
     $query = array(
       'link' => $link,
@@ -311,7 +314,7 @@ function shortcut_preprocess_page(&$variables) {
     // Check if $link is already a shortcut and set $link_mode accordingly.
     $shortcuts = \Drupal::entityManager()->getStorage('shortcut')->loadByProperties(array('shortcut_set' => $shortcut_set->id()));
     foreach ($shortcuts as $shortcut) {
-      if ($shortcut->getRouteName() == $route_match->getRouteName() && $shortcut->getRouteParameters() == $route_match->getParameters()->all()) {
+      if ($shortcut->getRouteName() == $url->getRouteName() && $shortcut->getRouteParameters() == $url->getRouteParameters()) {
         $shortcut_id = $shortcut->id();
         break;
       }
diff --git a/core/modules/system/entity.api.php b/core/modules/system/entity.api.php
index 9c590b3..5974440 100644
--- a/core/modules/system/entity.api.php
+++ b/core/modules/system/entity.api.php
@@ -1948,7 +1948,3 @@ function hook_entity_extra_field_info_alter(&$info) {
     }
   }
 }
-
-/**
- * @} End of "addtogroup hooks".
- */
diff --git a/index.php b/index.php
index 406d3dc..d8be057 100644
--- a/index.php
+++ b/index.php
@@ -15,9 +15,15 @@
 $autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
 
 try {
-
-  $request = Request::createFromGlobals();
-  $kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod');
+  try {
+    $request = Request::createFromGlobals();
+    $kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod');
+  }
+  catch (\UnexpectedValueException $e) {
+    http_response_code(400);
+    print '400 Bad Request';
+    exit;
+  }
   $response = $kernel
       ->handle($request)
       // Handle the response object.