Fix reachable security issues found in the audit

2026-10-21 18:30:50 -07:00
parent 524bc0252e
commit 883fa797d4
1 changed files with 14 additions and 1 deletions
@@ -164,7 +164,20 @@ private final class PageListener: @unchecked Sendable {
    }

    private func serve(_ conn: NWConnection, _ head: String) {
-        let parts = head.components(separatedBy: "\r\n")[0].split(separator: " ")
+        let lines = head.components(separatedBy: "\r\n")
+        let hosts = lines.dropFirst().compactMap { line -> String? in
+            guard let colon = line.firstIndex(of: ":"), line[..<colon].lowercased() == "host" else {
+                return nil
+            }
+            return line[line.index(after: colon)...].trimmingCharacters(in: .whitespaces)
+        }
+        // A browser must not reach this authenticated file bridge through a
+        // hostname that an attacker can rebind to loopback.
+        guard let port = listener?.port, hosts == ["127.0.0.1:\(port.rawValue)"] else {
+            respond(conn, 403, "text/plain; charset=utf-8", Data("forbidden host".utf8))
+            return
+        }
+        let parts = lines[0].split(separator: " ")
        guard parts.count == 3, parts[0] == "GET", let path = URLComponents(string: String(parts[1]))?.path else {
            respond(conn, 400, "text/plain; charset=utf-8", Data("bad request".utf8))
            return