nativescript 9.0.6-rc.1 → 9.0.6-rc.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -7,9 +7,17 @@ const fs = require("fs");
|
|
|
7
7
|
const constants_1 = require("../constants");
|
|
8
8
|
const yok_1 = require("../common/yok");
|
|
9
9
|
const LOOPBACK_HOST = "127.0.0.1";
|
|
10
|
-
const DEVTOOLS_ORIGIN = "https://chrome-devtools-frontend.appspot.com";
|
|
11
10
|
const PORT_RANGE_START = 41500;
|
|
12
11
|
const PORT_RANGE_END = 41999;
|
|
12
|
+
// Allowed Chrome DevTools origins. Bundled DevTools (devtools://devtools)
|
|
13
|
+
// is the default flow opened by chrome://inspect; the appspot frontend is
|
|
14
|
+
// used when the CLI prints a hosted URL. Any other origin (including
|
|
15
|
+
// custom NS DevTools forks) gets a permissive ACAO since loopback bind
|
|
16
|
+
// is the real security boundary anyway.
|
|
17
|
+
const KNOWN_DEVTOOLS_ORIGINS = new Set([
|
|
18
|
+
"devtools://devtools",
|
|
19
|
+
"https://chrome-devtools-frontend.appspot.com",
|
|
20
|
+
]);
|
|
13
21
|
const CONTENT_TYPES = {
|
|
14
22
|
".map": "application/json; charset=utf-8",
|
|
15
23
|
".json": "application/json; charset=utf-8",
|
|
@@ -98,7 +106,11 @@ class DevtoolsHostService {
|
|
|
98
106
|
return `http://${LOOPBACK_HOST}:${port}`;
|
|
99
107
|
}
|
|
100
108
|
handleRequest(req, res, rootDir) {
|
|
101
|
-
|
|
109
|
+
const requestOrigin = req.headers.origin;
|
|
110
|
+
const allowOrigin = requestOrigin && KNOWN_DEVTOOLS_ORIGINS.has(requestOrigin)
|
|
111
|
+
? requestOrigin
|
|
112
|
+
: "*";
|
|
113
|
+
res.setHeader("Access-Control-Allow-Origin", allowOrigin);
|
|
102
114
|
res.setHeader("Vary", "Origin");
|
|
103
115
|
res.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
|
|
104
116
|
res.setHeader("Access-Control-Allow-Headers", "*");
|
package/package.json
CHANGED