com.jimuwd.xian.registry-proxy 1.0.121 → 1.0.123

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/index.js +4 -4
  2. package/package.json +1 -1
package/dist/index.js CHANGED
@@ -299,7 +299,7 @@ function getDownstreamClientIp(req) {
299
299
  // 直接连接时,取 socket.remoteAddress
300
300
  return req.socket.remoteAddress;
301
301
  }
302
- // 同时启动ipv6,ipv4监听,比如当客户端访问http://localhost:port时,无论客户端DNS解析到IPV4-127.0.0.1还是IPV6-::1地址,咱server都能轻松应对!
302
+ // deprecated 出于安全考虑只监听::1地址,废弃本注释:同时启动ipv6,ipv4监听,比如当客户端访问http://localhost:port时,无论客户端DNS解析到IPV4-127.0.0.1还是IPV6-::1地址,咱server都能轻松应对!
303
303
  export async function startProxyServer(proxyConfigPath, localYarnConfigPath, globalYarnConfigPath, port = 0) {
304
304
  const proxyInfo = await loadProxyInfo(proxyConfigPath, localYarnConfigPath, globalYarnConfigPath);
305
305
  const registryInfos = proxyInfo.registries;
@@ -358,7 +358,7 @@ export async function startProxyServer(proxyConfigPath, localYarnConfigPath, glo
358
358
  resToDownstreamClient.writeHead(404).end('All upstream registries failed');
359
359
  }
360
360
  };
361
- // 注意:需要同时启动ipv6,ipv4监听,比如当客户端访问http://localhost:port时,无论客户端DNS解析到IPV4-127.0.0.1还是IPV6-::1地址,咱server都能轻松应对!
361
+ // deprecated 废弃本注释:需要同时启动ipv6,ipv4监听,比如当客户端访问http://localhost:port时,无论客户端DNS解析到IPV4-127.0.0.1还是IPV6-::1地址,咱server都能轻松应对!
362
362
  let server;
363
363
  if (proxyInfo.https) {
364
364
  const { key, cert } = proxyInfo.https;
@@ -406,8 +406,8 @@ export async function startProxyServer(proxyConfigPath, localYarnConfigPath, glo
406
406
  };
407
407
  server.on('error', errHandler /*this handler will call 'reject'*/);
408
408
  server.on('connection', connectionHandler);
409
- // 为了代理服务器的健壮性,要同时监听ipv4、v6地址
410
- const listenOptions = { port, ipv6Only: false };
409
+ // 为了代理服务器的安全性,暂时只监听本机ipv6地址【::1】,不能对本机之外暴露本代理服务地址避免造成安全隐患
410
+ const listenOptions = { port, host: '::1', ipv6Only: true };
411
411
  server.listen(listenOptions, () => {
412
412
  const addressInfo = server.address();
413
413
  port = addressInfo.port; // 回写上层局部变量
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "com.jimuwd.xian.registry-proxy",
3
- "version": "1.0.121",
3
+ "version": "1.0.123",
4
4
  "description": "A lightweight npm registry proxy with fallback support",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",