@volter/tabnode 0.5.2 → 0.5.3

package/dist/assets/{runtime-worker-CqG62h2U.js → runtime-worker-CfmZOVKz.js}

@@ -17595,10 +17595,17 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply = Function.prototype.apply;
+var functionApply;
+var hasRequiredFunctionApply;
+function requireFunctionApply() {
+  if (hasRequiredFunctionApply) return functionApply;
+  hasRequiredFunctionApply = 1;
+  functionApply = Function.prototype.apply;
+  return functionApply;
+}
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = functionApply;
+var $apply$1 = requireFunctionApply();
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -17718,7 +17725,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = functionApply;
+var $apply = requireFunctionApply();
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -18359,7 +18366,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = functionApply;
+  var $apply2 = requireFunctionApply();
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);

package/dist/index.mjs

@@ -17762,10 +17762,17 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply = Function.prototype.apply;
+var functionApply;
+var hasRequiredFunctionApply;
+function requireFunctionApply() {
+  if (hasRequiredFunctionApply) return functionApply;
+  hasRequiredFunctionApply = 1;
+  functionApply = Function.prototype.apply;
+  return functionApply;
+}
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = functionApply;
+var $apply$1 = requireFunctionApply();
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -17885,7 +17892,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = functionApply;
+var $apply = requireFunctionApply();
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -18526,7 +18533,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = functionApply;
+  var $apply2 = requireFunctionApply();
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);
@@ -35548,7 +35555,7 @@ class WorkerRuntime {
     this.worker = new Worker(
       new URL(
         /* @vite-ignore */
-        "/assets/runtime-worker-CqG62h2U.js",
+        "/assets/runtime-worker-CfmZOVKz.js",
         import.meta.url
       ),
       { type: "module" }
@@ -37408,11 +37415,15 @@ function __substrateListenForUpgrades(bridge) {
       const key = uint8ToBase64(crypto.getRandomValues(new Uint8Array(16)));
       const protocols = Array.isArray(data2.protocols) ? data2.protocols : [];
       void __upgradeOverLoopback(port, "GET", url2.pathname + url2.search, {
-        Host: url2.host,
+        // Host is the authority the client addressed, as an HTTP request's is
+        Host: typeof data2.host === "string" && /^(?:\[[0-9a-f:.]+\]|[a-z0-9.-]+)(?::[0-9]{1,5})?$/iu.test(data2.host) ? data2.host : url2.host,
         Upgrade: "websocket",
         "Sec-WebSocket-Version": "13",
         "Sec-WebSocket-Key": key,
-        ...protocols.length ? { "Sec-WebSocket-Protocol": protocols.join(", ") } : {}
+        ...protocols.length ? { "Sec-WebSocket-Protocol": protocols.join(", ") } : {},
+        // A browser sends Origin on every WebSocket handshake, and a server's
+        // check of it is how it refuses sockets from pages it did not serve.
+        ...typeof data2.origin === "string" && /^https?:\/\/[^/]+$/u.test(data2.origin) ? { Origin: data2.origin } : {}
       }).then((result) => {
         if (result.statusCode !== 101 || !result.socket) {
           channel.postMessage({ type: "close", targetClient: data2.clientId, code: 1006, reason: "upgrade refused" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/server-bridge.ts

@@ -123,6 +123,10 @@ interface UpgradeSignal {
   protocols?: string[];
   /** `"none"` asks for a byte pipe; anything else, or nothing, is a WebSocket. */
   framing?: "websocket" | "none";
+  /** The origin of the page that opened the socket, which a browser sends on every handshake. */
+  origin?: string;
+  /** The authority the client addressed, its handshake's Host; the engine's own URL names the port. */
+  host?: string;
   payload?: string | ArrayBuffer;
   code?: number;
   reason?: string;
@@ -348,11 +352,15 @@ function __substrateListenForUpgrades(bridge: ServerBridge): BroadcastChannel |
       // with the socket, which is what the real `ws` takes over. What comes
       // back here is the client's end of that same connection.
       void __upgradeOverLoopback(port, "GET", url2.pathname + url2.search, {
-        Host: url2.host,
+        // Host is the authority the client addressed, as an HTTP request's is
+        Host: typeof data2.host === "string" && /^(?:\[[0-9a-f:.]+\]|[a-z0-9.-]+)(?::[0-9]{1,5})?$/iu.test(data2.host) ? data2.host : url2.host,
         Upgrade: "websocket",
         "Sec-WebSocket-Version": "13",
         "Sec-WebSocket-Key": key,
         ...(protocols.length ? { "Sec-WebSocket-Protocol": protocols.join(", ") } : {}),
+        // A browser sends Origin on every WebSocket handshake, and a server's
+        // check of it is how it refuses sockets from pages it did not serve.
+        ...(typeof data2.origin === "string" && /^https?:\/\/[^/]+$/u.test(data2.origin) ? { Origin: data2.origin } : {}),
       }).then((result) => {
         if (result.statusCode !== 101 || !result.socket) {
           channel.postMessage({ type: "close", targetClient: data2.clientId, code: 1006, reason: "upgrade refused" });