From 016ccbe1c095a3eed7967737ac1d4df2754f5d96 Mon Sep 17 00:00:00 2001 From: Michael Panchenko Date: Tue, 26 May 2026 11:44:27 +0200 Subject: [PATCH] Dashboard: validate host and port on each request --- src/serena/dashboard.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/serena/dashboard.py b/src/serena/dashboard.py index 66c93827..f5e4ec0c 100644 --- a/src/serena/dashboard.py +++ b/src/serena/dashboard.py @@ -15,7 +15,7 @@ from pathlib import Path from typing import TYPE_CHECKING, Any, Optional, Self import psutil -from flask import Flask, Response, redirect, request, send_from_directory +from flask import Flask, Response, abort, redirect, request, send_from_directory from PIL import Image from pydantic import BaseModel from sensai.util import logging @@ -776,7 +776,15 @@ class SerenaDashboardAPI: cli.show_server_banner = lambda *args, **kwargs: None + # Verify host and port on each request to prevent DNS-rebinding-based attacks + @self._app.before_request + def check_host() -> None: + allowed = {f"127.0.0.1:{port}", f"localhost:{port}"} + if request.host not in allowed: + abort(403) + self._app.run(host=host, port=port, debug=False, use_reloader=False, threaded=True) + return port def run_in_thread(self, host: str) -> tuple[threading.Thread, int]: