autotel-devtools 8.0.0 → 8.1.0

package/dist/server/exporter.d.cts

@@ -1,4 +1,4 @@
 import '@opentelemetry/sdk-trace-base';
 import '@opentelemetry/core';
-export { a as DevtoolsSpanExporter } from '../exporter-DjLkU621.cjs';
+export { a as DevtoolsSpanExporter } from '../exporter-De6p4iAD.cjs';
 import 'node:http';

package/dist/server/exporter.d.ts

@@ -1,4 +1,4 @@
 import '@opentelemetry/sdk-trace-base';
 import '@opentelemetry/core';
-export { a as DevtoolsSpanExporter } from '../exporter-DjLkU621.js';
+export { a as DevtoolsSpanExporter } from '../exporter-De6p4iAD.js';
 import 'node:http';

package/dist/server/index.cjs

@@ -363,6 +363,40 @@ function applyTelemetryLimits(data, limits) {
   };
 }
 
+// src/server/origin-guard.ts
+var LOOPBACK_IPV6 = /* @__PURE__ */ new Set(["::1", "0:0:0:0:0:0:0:1"]);
+function isLoopbackHostname(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || /^127\./.test(h) || LOOPBACK_IPV6.has(h);
+}
+function hostnameFromHostHeader(host) {
+  const h = host.trim();
+  if (h.startsWith("[")) {
+    const end = h.indexOf("]");
+    return end > 0 ? h.slice(1, end) : h;
+  }
+  const colon = h.indexOf(":");
+  return colon === -1 ? h : h.slice(0, colon);
+}
+function hostHeaderIsLoopback(host) {
+  return isLoopbackHostname(hostnameFromHostHeader(host));
+}
+function originIsLoopback(origin) {
+  try {
+    return isLoopbackHostname(new URL(origin).hostname);
+  } catch {
+    return false;
+  }
+}
+function allowSensitiveRequest(headers, loopbackOnly) {
+  const { origin, host } = headers;
+  if (origin && origin.length > 0 && !originIsLoopback(origin)) return false;
+  if (loopbackOnly && host && host.length > 0 && !hostHeaderIsLoopback(host)) {
+    return false;
+  }
+  return true;
+}
+
 // src/server/server.ts
 var DevtoolsServer = class {
   wss;
@@ -382,7 +416,12 @@ var DevtoolsServer = class {
     this._port = options.port ?? 4318;
     this.onData = options.onData;
     this.httpServer = options.server ?? http.createServer();
-    this.wss = new ws.WebSocketServer({ server: this.httpServer, path: options.path ?? "/ws" });
+    const loopbackOnly = options.host == null || hostHeaderIsLoopback(options.host);
+    this.wss = new ws.WebSocketServer({
+      server: this.httpServer,
+      path: options.path ?? "/ws",
+      verifyClient: ({ origin, req }) => allowSensitiveRequest({ origin, host: req.headers.host }, loopbackOnly)
+    });
     this.wss.on("error", (err) => {
       if (this.httpServer.listening) throw err;
     });
@@ -1481,7 +1520,8 @@ function getWidgetJs() {
   }
   return cachedWidgetJs;
 }
-function attachDevtoolsRoutes(httpServer, devtools) {
+function attachDevtoolsRoutes(httpServer, devtools, options = {}) {
+  const loopbackOnly = options.loopbackOnly ?? true;
   httpServer.on("request", async (req, res) => {
     res.setHeader("Access-Control-Allow-Origin", "*");
     res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
@@ -1515,11 +1555,19 @@ function attachDevtoolsRoutes(httpServer, devtools) {
       return;
     }
     if (req.method === "GET" && url === "/v1/traces") {
+      if (!allowSensitiveRequest(req.headers, loopbackOnly)) {
+        sendJson(res, 403, { error: "Forbidden" });
+        return;
+      }
       const data = devtools.getCurrentData();
       sendJson(res, 200, { traces: data.traces, count: data.traces.length });
       return;
     }
     if (req.method === "DELETE" && url === "/v1/traces") {
+      if (!allowSensitiveRequest(req.headers, loopbackOnly)) {
+        sendJson(res, 403, { error: "Forbidden" });
+        return;
+      }
       devtools.clearData();
       sendJson(res, 200, { cleared: true });
       return;
@@ -1571,6 +1619,7 @@ exports.DevtoolsRemoteExporter = DevtoolsRemoteExporter;
 exports.DevtoolsServer = DevtoolsServer;
 exports.DevtoolsSpanExporter = DevtoolsSpanExporter;
 exports.ErrorAggregator = ErrorAggregator;
+exports.allowSensitiveRequest = allowSensitiveRequest;
 exports.appendManyWithLimit = appendManyWithLimit;
 exports.appendWithLimit = appendWithLimit;
 exports.applyTelemetryLimits = applyTelemetryLimits;
@@ -1579,7 +1628,10 @@ exports.createDevtoolsHttpServer = createDevtoolsHttpServer;
 exports.decodeOtlpLogsRequest = decodeOtlpLogsRequest;
 exports.decodeOtlpMetricsRequest = decodeOtlpMetricsRequest;
 exports.decodeOtlpTraceRequest = decodeOtlpTraceRequest;
+exports.hostHeaderIsLoopback = hostHeaderIsLoopback;
+exports.isLoopbackHostname = isLoopbackHostname;
 exports.isProtobufContentType = isProtobufContentType;
+exports.originIsLoopback = originIsLoopback;
 exports.parseOtlpLogs = parseOtlpLogs;
 exports.parseOtlpTraces = parseOtlpTraces;
 exports.probePortHolder = probePortHolder;