From 3240403ab1c2a8af09ca976770184db84c4521c3 Mon Sep 17 00:00:00 2001 From: Michael Panchenko Date: Thu, 28 May 2026 11:29:10 +0200 Subject: [PATCH] Dashboard: configure trusted hosts directly in flask app --- src/serena/dashboard.py | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/src/serena/dashboard.py b/src/serena/dashboard.py index f5e4ec0c..914b28e5 100644 --- a/src/serena/dashboard.py +++ b/src/serena/dashboard.py @@ -15,7 +15,7 @@ from pathlib import Path from typing import TYPE_CHECKING, Any, Optional, Self import psutil -from flask import Flask, Response, abort, redirect, request, send_from_directory +from flask import Flask, Response, redirect, request, send_from_directory from PIL import Image from pydantic import BaseModel from sensai.util import logging @@ -202,6 +202,9 @@ class SerenaDashboardAPI: self._tool_names = tool_names self._agent = agent self._app = Flask(__name__) + + self._app.config["TRUSTED_HOSTS"] = ["127.0.0.1", "localhost"] + self._tool_usage_stats = tool_usage_stats self._loaded_news: dict[str, str] = {} self._news_ready = threading.Event() @@ -775,16 +778,7 @@ class SerenaDashboardAPI: from flask import cli cli.show_server_banner = lambda *args, **kwargs: None - - # Verify host and port on each request to prevent DNS-rebinding-based attacks - @self._app.before_request - def check_host() -> None: - allowed = {f"127.0.0.1:{port}", f"localhost:{port}"} - if request.host not in allowed: - abort(403) - self._app.run(host=host, port=port, debug=False, use_reloader=False, threaded=True) - return port def run_in_thread(self, host: str) -> tuple[threading.Thread, int]: