atris 3.72.3 → 3.72.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/site.js +5 -0
- package/package.json +1 -1
package/lib/site.js
CHANGED
|
@@ -106,6 +106,11 @@ function serveSite(dir, port = 4321) {
|
|
|
106
106
|
let realRoot = root;
|
|
107
107
|
try { realRoot = fs.realpathSync(root); } catch { /* missing folder: every request 404s */ }
|
|
108
108
|
const server = http.createServer((req, res) => {
|
|
109
|
+
// Only answer requests addressed to this computer, so another website cannot
|
|
110
|
+
// reach the preview by pointing its own name at 127.0.0.1.
|
|
111
|
+
const port = server.address() && server.address().port;
|
|
112
|
+
const host = String(req.headers.host || '').toLowerCase();
|
|
113
|
+
if (![`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`].includes(host)) { res.writeHead(403); res.end('forbidden'); return; }
|
|
109
114
|
let rel;
|
|
110
115
|
try { rel = decodeURIComponent((req.url || '/').split('?')[0]); }
|
|
111
116
|
catch { res.writeHead(400); res.end('bad request'); return; }
|