rack_web_console 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a4d00b4ee750af6eb2782b71b432f411964fbd4a
-  data.tar.gz: 60be9ea39bd4756d4b9dac911678ae8752d6f0bd
+  metadata.gz: dcd27bbf7602dceca8c4f8a932e4357b6fa71a86
+  data.tar.gz: 41d49308a3c17ebca10343b53151f4b89954edd2
 SHA512:
-  metadata.gz: 076756194180b419477fc145a67ac1c01e276ddca634d359d0c05de23186b1963da0c15eff378648573b16b7d85e7bc64f04133b1d8e6cb4f43a1725e2406995
-  data.tar.gz: ece2517ff410af142bd1a5d8447f511611b6e3fe4e8044e5a99221ae2881d28f8215d0eb5f92c83d5bdb4bd321441bccb0b9dd6316acdcff0c19396379de37cd
+  metadata.gz: abd3d2c15e9dead6eb862166110c2d3345c6a316bdd61d6c2df9228e93877ed569cae64281169cd940a688b41b4afb94661122fa2aa1db9c03dca483594e6095
+  data.tar.gz: bff88e035f39d359e6c064ae16ce55f178c83f8f824a80ed34efb0118e4fc803636404da801f489b9e7add0c4a5fee9a57ad0ade3bb7af3d63b31dd54d54481d

data/README.md

@@ -41,7 +41,7 @@ require 'rack_web_console'
 
 class App < Roda
   route do |r|
-    r.on('console'){ halt RackConsole.new(binding) }
+    r.on('console'){ halt RackConsole.new(binding) } if ENV['RACK_ENV'] == 'development'
     'default response'
   end
 end

data/lib/rack_console/version.rb

@@ -1,3 +1,3 @@
 class RackConsole
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

data/lib/rack_web_console.rb

@@ -20,6 +20,7 @@ class RackConsole
 
 
   def process_script(env)
+    return [403, {}, []] unless same_origin?(env)
     script = CGI.unescape env['rack.input'].read.sub(/\Ascript=/, '')
     @_storage&.script=(script)
     result = []
@@ -37,6 +38,14 @@ class RackConsole
     [ 200, headers, [ result.join("\n").gsub("\n", "<br>\n") ] ]
   end
 
+  def same_origin?(env)
+    env['HTTP_HOST'] == (domain_from(env['HTTP_ORIGIN']) || domain_from(env['HTTP_REFERER']))
+  end
+
+  def domain_from(referer)
+    referer && referer.gsub(%r{(?:\Ahttps?://|/.*)}, '')
+  end
+
   def render_view(env)
     [ 200, { 'Content-Type' => 'text/html; charset=utf-8' }, [ view_response(env) ] ]
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack_web_console
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Rodrigo Rosenfeld Rosas