dsh-code-server-app 0.2.0 → 0.2.1

package/README.en.md

@@ -40,6 +40,11 @@ A static profile plugin (npm package with host + client bundle) that ships the *
   **WebSockets** cannot be routed because `registerUpgrade` matches exact paths while `/proxy/:port` carries the port in
   the path (HTTP forwarding works; use `loopback` when you need WS forwarding).
 
+- In `loopback` mode every upgrade passes a **code-server-equivalent Origin check** (since 0.2.1): when an `Origin`
+  header is present its host must equal `Host` (honouring `Forwarded: host=` / `X-Forwarded-Host`, like code-server),
+  otherwise the handshake gets `403`; non-browser requests without `Origin` are allowed. Without that check any local
+  browser page could complete a handshake against `ws://127.0.0.1:<port>/stable-<commit>` and drive the IDE.
+
 
 - **Floating ball** (bottom-right, official code-server icon, above the composer): click to **expand the floating window and light it up** (blue glow), click again to **collapse**; **drag to any position** (remembered across refreshes; no accidental click after drag);
   no sidebar button, no window control button group (the ball is the only entry/toggle); the ball carries a status dot (green = running / amber = starting / red = error);
@@ -121,9 +126,9 @@ pnpm run promote -- <version>
 
 ```powershell
 # no postinstall in the package → no pnpm approve-builds / allowBuilds; one command installs everything
-dsh plugin --profile web add dsh-code-server-app@0.2.0
+dsh plugin --profile web add dsh-code-server-app@0.2.1
 # a local tarball works the same way:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.2.0.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.2.1.tgz
 ```
 
 Ready to use immediately — **no second step, no "Install environment", no install-guide modal**.

package/README.md

@@ -53,6 +53,10 @@
   2. 转发端口(Ports 面板)的 **WebSocket** 无法用精确升级路由覆盖(端口号在路径里)→ 该功能在 `dsh` 模式下不可用;
      HTTP 转发端口正常;需要端口转发 WS 时请用 `loopback` 模式。
 
+- `loopback` 模式下 upgrade 会做 **code-server 同款 Origin 校验**(0.2.1 起):带 `Origin` 时其 host 必须等于 `Host`
+  (含 `Forwarded: host=` / `X-Forwarded-Host` 的反代语义),否则回 `403`;缺 `Origin` 的非浏览器请求放行。
+  没有这道检查时,本机任意浏览器页面都能对 `ws://127.0.0.1:<port>/stable-<commit>` 完成握手并驱动 IDE。
+
 ## 悬浮球 / 浮窗(仅旧版 DSH 回退路径)
 
 - **右下角悬浮球**(code-server 官方图标,输入框上方):点击**展开浮窗并亮起**(蓝色光环),再点击**收起并复原**;
@@ -136,9 +140,9 @@ pnpm run promote -- <version>
 
 ```powershell
 # 包内无 postinstall → 无需 pnpm approve-builds / allowBuilds;一条命令装完
-dsh plugin --profile web add dsh-code-server-app@0.2.0
+dsh plugin --profile web add dsh-code-server-app@0.2.1
 # 本地 tarball 同理:
-dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.2.0.tgz
+dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app\dsh-code-server-app-0.2.1.tgz
 ```
 
 装完即用,**没有第二步、没有「安装环境」、不弹安装指引**。主包约 **110KB**(插件自身代码 + launcher),

package/lib/launcher.mjs

@@ -207,6 +207,56 @@ function handleProxyUpgrade(req, socket, head, target) {
   socket.on('close', () => upstream.destroy());
 }
 
+// ---------------------------------------------------------------- 跨源防护(等价 code-server 的 ensureOrigin)
+
+/** 取请求 Host:优先 `Forwarded: host=`、其次 `X-Forwarded-Host`(取第一个)、最后 `Host`。
+ *  trim + 小写,与 code-server 的 getHost() 同语义(反向代理未透传 Host 时返回 undefined)。 */
+function getHostHeader(req) {
+  const first = (name) => {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+  };
+  const forwarded = first('forwarded');
+  if (forwarded !== undefined && forwarded !== '') {
+    for (const part of forwarded.split(/[;,]/)) {
+      const eq = part.indexOf('=');
+      if (eq < 0) continue;
+      const key = part.slice(0, eq).trim().toLowerCase();
+      const value = part.slice(eq + 1).trim();
+      if (key === 'host' && value !== '') return value.toLowerCase();
+    }
+  }
+  const xHost = first('x-forwarded-host');
+  if (xHost !== undefined && xHost !== '') {
+    const head = xHost.split(',')[0];
+    if (head !== undefined && head.trim() !== '') return head.trim().toLowerCase();
+  }
+  const host = first('host');
+  return host !== undefined && host !== '' ? host.trim().toLowerCase() : undefined;
+}
+
+/** code-server `authenticateOrigin()` 的等价物:带 Origin 的请求(浏览器)其 host 必须等于 Host;
+ *  缺 Origin(非浏览器,如本地工具/测试)放行。code-server 另外支持 `--trusted-origins` /
+ *  `--proxy-domain` 通配,本插件没有这两个概念,故不实现。
+ *  为什么必须有:VS Code 的 handleUpgrade 不校验来源,而 IDE 是 auth=none —— 缺了这道检查,
+ *  本机任意浏览器页面都能开 ws://127.0.0.1:<port>/stable-<commit> 直接驱动 IDE。
+ *  (dsh 模式下请求来自 DSH 自己的路由并已过 requestRejection,Origin/Host 天然一致。) */
+function originAllowed(req) {
+  const raw = req.headers.origin;
+  const originRaw = Array.isArray(raw) ? raw[0] : raw;
+  if (originRaw === undefined || originRaw === '') return true;
+  let origin;
+  try {
+    origin = new URL(originRaw).host.trim().toLowerCase();
+  } catch {
+    return false;
+  }
+  if (origin === '') return false;
+  const host = getHostHeader(req);
+  if (host === undefined) return false;
+  return host === origin;
+}
+
 // ---------------------------------------------------------------- HTTP / WS 分发
 
 const server = createHttpServer((req, res) => {
@@ -243,6 +293,12 @@ server.on('upgrade', (req, socket, head) => {
   const url = req.url ?? '/';
   recentUpgrades.push(url);
   if (recentUpgrades.length > 10) recentUpgrades.shift();
+  // 跨源防护(与 code-server 一致:只卡 upgrade,HTTP 侧 VS Code 仅接受 GET 且状态变更都走 WS)
+  if (!originAllowed(req)) {
+    log(`拒绝跨源 WebSocket:origin=${req.headers.origin} host=${req.headers.host ?? '-'} url=${url}`);
+    socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    return;
+  }
   if (!args.disableProxy) {
     const target = proxyTarget(url);
     if (target !== null) { handleProxyUpgrade(req, socket, head, target); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "VS Code (from a code-server release) inside DSH Web and Desktop: right-sidebar tab with a floating-ball fallback, driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.136.1",
   "productPath": "stable-8d5f383f301ca20681f5b6606b8207d9dc87bdd8",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-10T08:30:15.204Z",
+  "preparedAt": "2026-09-10T09:02:13.757Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",