@servicenow/aiux 22.42.1 → 22.42.3

package/public-dev-server/server/src/glide-proxy.js

@@ -15,9 +15,32 @@ import {fetch as undiciFetch} from 'undici';
  * authenticate as the interacting logged-in user).
  */
 
-// Hop-by-hop headers that must not be forwarded (RFC 7230 §6.1) + encoding
-// we don't want to re-interpret.
-const STRIP_REQUEST_HEADERS = new Set(['host', 'connection', 'content-length']);
+// Hop-by-hop headers that must not be forwarded (RFC 7230 §6.1) + `host`,
+// which we overwrite with the instance host below.
+//
+// `content-length` is deliberately NOT here: it is an end-to-end header, and
+// the body is forwarded as an unread stream (see the content-type parser
+// below), so undici cannot recompute it. Stripping it made undici fall back to
+// `Transfer-Encoding: chunked`, which Glide's servlet stack rejects with
+// 411 Length Required, killing every bodied POST, most visibly the single
+// /api/now/v1/batch request that carries a page's widget data (DEF0879731).
+// Since the proxy never touches the body bytes, the browser's own
+// Content-Length stays numerically correct.
+//
+// `transfer-encoding` IS stripped: it describes the client->dev-server hop
+// only, and undici throws `invalid transfer-encoding header` if it is set on
+// an outgoing fetch (undici owns framing for the upstream hop). Same rationale
+// as prod's h2-proxy, which strips host/connection/transfer-encoding/
+// keep-alive/upgrade and passes content-length through untouched.
+const STRIP_REQUEST_HEADERS = new Set([
+  'host',
+  'connection',
+  'keep-alive',
+  'transfer-encoding',
+  'upgrade',
+  // undici rejects an outgoing `expect` header outright.
+  'expect'
+]);
 const STRIP_RESPONSE_HEADERS = new Set([
   'transfer-encoding',
   'connection',

package/public-dev-server/server/src/server.js

@@ -339,6 +339,21 @@ export async function createSimpleDevServer({
   // local dev tool — no graceful-drain requirement.
   const fastify = Fastify({logger: false, forceCloseConnections: true});
 
+  // Bind is wildcard (0.0.0.0), not loopback — macOS returns EACCES binding
+  // 127.0.0.1 on a privileged port (<1024), so :80 only works via wildcard.
+  // Reject anything not from the loopback interface here instead: local dev
+  // tool running unsandboxed customer code, must not be reachable from the LAN.
+  const LOOPBACK_ADDRESSES = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+  fastify.addHook('onRequest', async (req, reply) => {
+    if (!LOOPBACK_ADDRESSES.has(req.socket.remoteAddress)) {
+      return reply
+        .code(403)
+        .send(
+          'Forbidden: this dev server only accepts connections from localhost.'
+        );
+    }
+  });
+
   // --- HMR client script ---
   // Served at a fixed path and injected into every rendered document (below) so
   // the browser opens the HMR WebSocket and full-reloads on rebuild. Null when