tiennm99/ccs
1
0 Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-10-14 02:15:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): reject 127-prefixed websocket origins (#1263)

Browse Source 
* fix(security): reject 127-prefixed websocket origins

* style: apply prettier formatting
This commit is contained in:
Kai (Tam Nhu) Tran authored and GitHub committed 2026-05-16 13:56:10 -04:00
1 parent 423708f28f
commit 14cbe8fb67
2 files changed
+14 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/unit/web-server/auth-middleware.test.ts
+12
View File
@@ -239,6 +239,18 @@ describe('Dashboard Auth', () => {
expect(isDashboardWebSocketUpgradeAllowed(request)).toBe(true);
});
it('blocks 127-prefixed DNS names from loopback websocket origin aliases', () => {
process.env.CCS_DASHBOARD_AUTH_ENABLED = 'false';
const request = makeUpgradeRequest('127.0.0.1', false, {
host: 'localhost:3001',
origin: 'http://127.evil.example.test:3001',
});
expect(isDashboardWebSocketOriginAllowed(request)).toBe(false);
expect(isDashboardWebSocketUpgradeAllowed(request)).toBe(false);
expect(getDashboardWebSocketRejectionStatus(request)).toBe(403);
});
it('blocks cross-site websocket origins even with an authenticated session', () => {
process.env.CCS_DASHBOARD_AUTH_ENABLED = 'true';
const request = makeUpgradeRequest('127.0.0.1', true, {