neotoma 0.5.0 → 0.6.0

package/dist/actions.d.ts

@@ -1,6 +1,18 @@
 import express from "express";
 export declare const app: import("express-serve-static-core").Express;
-/** True when request is to localhost/127.0.0.1 (local access). Tunnel requests have a non-local Host. */
+/**
+ * True when the request arrived over a loopback socket.
+ *
+ * SECURITY: derived from the TCP socket's remote address, NOT the `Host`
+ * header. `req.headers.host` is attacker-controlled; using it to gate
+ * authentication / auto-approval produces a trivial bypass when the server is
+ * bound to a non-loopback interface. We check `req.socket.remoteAddress`
+ * directly so spoofed `Host: localhost` headers do not promote a remote
+ * caller into the local-dev trust zone.
+ *
+ * Express's `req.ip` is also unsafe here because `trust proxy` honours the
+ * X-Forwarded-For header — any caller can claim to be loopback.
+ */
 export declare function isLocalRequest(req: express.Request): boolean;
 export declare function startHTTPServer(): Promise<{
     server: import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsF9B,eAAO,MAAM,GAAG,6CAAY,CAAC;AA2M7B,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAK5D;AA2gKD,wBAAsB,eAAe;;;eAgCpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAmH9B,eAAO,MAAM,GAAG,6CAAY,CAAC;AAkQ7B;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAU5D;AAs5LD,wBAAsB,eAAe;;;eAgCpC"}