tlsd 2.20.1 → 2.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tlsd",
-  "version": "2.20.1",
+  "version": "2.20.2",
   "description": "A server for web app prototyping with HTTPS and Websockets",
   "main": "tlsd.js",
   "bin": {

package/tlsd.js

@@ -43,6 +43,30 @@ const RATE_LIMIT_MAX_REQUESTS = toInt( process.env.RATE_LIMIT_MAX_REQUESTS ) ||
 
 let dev_mode = false;
 
+function public_origin_matches_host( origin, host ) {
+	if( ! origin ) {
+		return false;
+	}
+	const httpOrigin = "http://" + host;
+	const httpsOrigin = "https://" + host;
+	if( dev_mode ) {
+		return origin === httpOrigin || origin === httpsOrigin;
+	}
+	return origin === httpsOrigin;
+}
+
+function public_referer_matches_host( referer, host ) {
+	if( ! referer ) {
+		return false;
+	}
+	const httpRef = "http://" + host;
+	const httpsRef = "https://" + host;
+	if( dev_mode ) {
+		return referer.startsWith( httpRef ) || referer.startsWith( httpsRef );
+	}
+	return referer.startsWith( httpsRef );
+}
+
 // Connection tracking for DOS protection
 const ipConnections = new Map();
 let totalConnections = 0;
@@ -444,11 +468,9 @@ function csrf_protection( root ) {
 		let originValid = false;
 
 		if( origin ) {
-			const expectedOrigin = ( dev_mode ? "http://" : "https://" ) + host;
-			originValid = origin === expectedOrigin;
+			originValid = public_origin_matches_host( origin, host );
 		} else if( referer ) {
-			const expectedReferer = ( dev_mode ? "http://" : "https://" ) + host;
-			originValid = referer.startsWith( expectedReferer );
+			originValid = public_referer_matches_host( referer, host );
 		}
 
 		// For PUT (e.g. file uploads), cookie + Origin/Referer is sufficient.
@@ -853,9 +875,9 @@ function ws_attach( server, msg_handler ) {
 
 		// Validate WebSocket origin matches host
 		if( origin ) {
-			const expectedOrigin = ( dev_mode ? "http://" : "https://" ) + host;
-			if( origin !== expectedOrigin ) {
-				W( "WS: Origin validation failed: " + origin + " expected: " + expectedOrigin );
+			if( ! public_origin_matches_host( origin, host ) ) {
+				const expectedHint = dev_mode ? "http(s)://" + host : "https://" + host;
+				W( "WS: Origin validation failed: " + origin + " expected: " + expectedHint );
 				activeWSConnections--;
 				totalConnections--;
 				release_ip_connection( remote_ip );