ledung 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -10,6 +10,7 @@ that changes `src/`, `web/` (not `web/dist/`) or `scripts/` without one (a commi
 is nothing user-facing in it).
 
 ## 2026-11-02
+- A request whose address doesn't parse is now refused with a 400, also on the live connection, without an error in the log (Fluffy-Fluffy-and-Bouncy/Project-Ledung#467)
 - Started at sign-in on macOS or Linux, or from Ledung.app, Ledung now gets the same PATH as in your terminal, so Update Ledung, Ledung's GitHub features and the tools your sessions use work after a login too; a shell profile that hangs delays the start by about ten seconds instead of stopping it. Switch Start Ledung when I sign in off and on in Settings to get it (#464)
 - Settings → About has an update channel, Public or Dev: on Dev an npm-installed Ledung gets dev builds before they go to everyone, and Update & restart now checks npm and updates an npm install with one click (#461)
 

package/dist/main.js

@@ -15541,12 +15541,16 @@ var LedungServer = class {
       this.handle(req, res).catch((e) => this.fail(res, e));
     });
     server.on("upgrade", (req, socket, head) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/ws" || !this.guard.hostAllowed(req) || !this.guard.originAllowed(req) || !this.guard.mayUse(req)) {
-        socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+      const refuse = (status) => {
+        socket.end(`HTTP/1.1 ${status}\r
+Connection: close\r
+\r
+`);
         setTimeout(() => socket.destroy(), 1e3).unref();
-        return;
-      }
+      };
+      const url = requestUrl(req);
+      if (!url) return refuse("400 Bad Request");
+      if (url.pathname !== "/ws" || !this.guard.hostAllowed(req) || !this.guard.originAllowed(req) || !this.guard.mayUse(req)) return refuse("403 Forbidden");
       const device = this.guard.deviceOf(req)?.id ?? null;
       const viaPublic = this.guard.isPublic(req);
       this.wss.handleUpgrade(req, socket, head, (ws) => this.onClient(ws, device, viaPublic));
@@ -15817,8 +15821,9 @@ var LedungServer = class {
     return computers;
   }
   async handle(req, res) {
+    const url = requestUrl(req);
+    if (!url) throw new HttpError(400, "Bad request path.");
     if (!this.guard.hostAllowed(req)) throw new HttpError(403, "Unknown host.");
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
     const remote = this.guard.isPublic(req);
     if (remote) {
       this.publicResponses.add(res);
@@ -16977,6 +16982,15 @@ var LedungServer = class {
   }
 };
 var bodies = /* @__PURE__ */ new WeakMap();
+var badPathTraced = false;
+function requestUrl(req) {
+  const url = URL.parse(req.url ?? "/", "http://127.0.0.1");
+  if (!url && !badPathTraced) {
+    badPathTraced = true;
+    exercisedLine("EXERCISED #467 refused a request path that does not parse");
+  }
+  return url;
+}
 function fromThisComputer(req) {
   const from = req.socket.remoteAddress ?? "";
   return from === "::1" || from.startsWith("127.") || from.startsWith("::ffff:127.");

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "ledung",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ledung",
-      "version": "1.3.0",
+      "version": "1.4.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "0.3.295",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ledung",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "license": "AGPL-3.0-only",
   "author": "Project Ledung <martin@projectledung.com>",
   "description": "Runs several Claude Code sessions locally and shows them in one place.",