@zhangfengshun/dsh-remote-ssh 2.3.7 → 2.3.8

package/lib/index.js

@@ -945,13 +945,18 @@ function normExec(r) {
 // HTTP 工具
 // ---------------------------------------------------------------------------
 
-function isTrusted(req) {
+function isTrusted(req, requireRequestedWith) {
   const secFetchSite = req.headers["sec-fetch-site"];
   if (secFetchSite === "cross-site") return false;
   const host = req.headers["host"];
   if (!host) return false;
   const hostname = String(host).split(":")[0].replace(/^\[/, "").replace(/\]$/, "");
-  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") return true;
+  if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "0.0.0.0") {
+    // CSRF 加固（PR #4 的服务端半边）：/remote-ssh/api/* 仅由本插件客户端调用，
+    // 其请求必带 x-requested-with；跨站 no-cors POST 无法携带非简单头，预检也会被拒。
+    if (requireRequestedWith && String(req.headers["x-requested-with"] || "").trim() !== "XMLHttpRequest") return false;
+    return true;
+  }
   return false;
 }
 
@@ -1503,7 +1508,9 @@ function apply(ctx, config) {
     kind: "prefix",
     path: "/remote-ssh/api",
     handler: async (req, res) => {
-      if (!isTrusted(req)) { writeError(res, new Error("forbidden"), 403); return; }
+      // CSRF 加固：/remote-ssh/api/* 仅由本插件客户端调用，强制校验其必带的
+      // x-requested-with 头（跨站攻击者无法在 no-cors POST 中携带非简单头）。
+      if (!isTrusted(req, true)) { writeJson(res, 403, { ok: false, error: { code: "csrf", message: "missing x-requested-with header" } }); return; }
       if (req.method !== "POST") { writeError(res, new Error("method not allowed"), 405); return; }
       const pathname = new URL(req.url || "/", "http://dsh.internal").pathname;
       if (!pathname.startsWith(API_BASE)) { writeError(res, new Error("not-found"), 404); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhangfengshun/dsh-remote-ssh",
-  "version": "2.3.7",
+  "version": "2.3.8",
   "description": "DSH web plugin: VSCode Remote-SSH-like remote development (SSH to supercomputers/servers, remote workspace, file explorer, integrated terminal), integrated with dsh-better-sidebar and DSH settings.",
   "keywords": [
     "dsh",