Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Always allow requests with IP-address as host in checkHost() #1007

Merged
merged 3 commits into from
Jul 27, 2017
Merged

Always allow requests with IP-address as host in checkHost() #1007

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d3fc704
Always allow requests with IP-address as host in checkHost()
usefulthink Jul 24, 2017
077337b
use 'ip'-module to handle ip-address validation.
usefulthink Jul 27, 2017
79219db
Merge branch 'master' into check-hosts-allow-ips
shellscape Jul 27, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion lib/Server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ const express = require("express");
const fs = require("fs");
const http = require("http");
const httpProxyMiddleware = require("http-proxy-middleware");
const ip = require("ip");
const serveIndex = require("serve-index");
const historyApiFallback = require("connect-history-api-fallback");
const path = require("path");
Expand Down Expand Up @@ -441,8 +442,11 @@ Server.prototype.checkHost = function(headers) {
const idx = hostHeader.indexOf(":");
const hostname = idx >= 0 ? hostHeader.substr(0, idx) : hostHeader;

// always allow requests with explicit IP-address
if(ip.isV4Format(hostname)) return true;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't it allow IPv6-adresses as well?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's true, good catch

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should I do another PR for this? Did anyone ever use IPv6 in such a context?
Using http://[::1]:1234/ is absolutely possible, but that will already break in the lines before as a colon no longer works to split out the port-number from the host-header.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be worthwhile to solve. I haven't heard of anyone using IPv6 in that way, but the call out by @trygveaa is valid. Totally up to you if you'd like to create a followup PR


// always allow localhost host, for convience
if(hostname === "127.0.0.1" || hostname === "localhost") return true;
if(hostname === "localhost") return true;

// allow if hostname is in allowedHosts
if(this.allowedHosts && this.allowedHosts.length) {
Expand Down
1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
"html-entities": "^1.2.0",
"http-proxy-middleware": "~0.17.4",
"internal-ip": "^1.2.0",
"ip": "^1.1.5",
"loglevel": "^1.4.1",
"opn": "4.0.2",
"portfinder": "^1.0.9",
Expand Down
11 changes: 11 additions & 0 deletions test/Validation.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,17 @@ describe("Validation", function() {
}
});

it("should allow access for every requests using an IP", function() {
const options = {};
const headers = {
host: "192.168.1.123"
};
const server = new Server(compiler, options);
if(!server.checkHost(headers)) {
throw new Error("Validation didn't fail");
}
});

it("should not allow hostnames that don't match options.public", function() {
const options = {
public: "test.host:80",
Expand Down