mirror of
https://github.com/software-mansion/argent.git
synced 2026-09-14 19:27:14 +08:00
Ignacy Łątka
5094c485d3
The tool-server binds to 127.0.0.1, but a public attacker page that DNS-rebinds its hostname to 127.0.0.1 still reaches us — the Host header is the only signal that distinguishes that traffic from a legitimate same-origin request. Adds an early middleware (runs before CORS) that 403s any request whose Host header is not a loopback name (127.0.0.1, localhost, ::1). IPv6 literals in brackets are normalised before the check. Without this, an attacker can pair a DNS-rebinding flow with the existing wildcard CORS to read /tools and POST to /tools/:name from any public origin.