wrangler 2.20.1 → 2.20.2

package/wrangler-dist/cli.js

@@ -36618,7 +36618,7 @@ var require_websocket2 = __commonJS({
     init_import_meta_url();
     var EventEmitter3 = require("events");
     var https2 = require("https");
-    var http3 = require("http");
+    var http2 = require("http");
     var net3 = require("net");
     var tls = require("tls");
     var { randomBytes, createHash } = require("crypto");
@@ -36979,7 +36979,7 @@ var require_websocket2 = __commonJS({
       const isSecure = parsedUrl.protocol === "wss:" || parsedUrl.protocol === "https:";
       const defaultPort = isSecure ? 443 : 80;
       const key = randomBytes(16).toString("base64");
-      const get = isSecure ? https2.get : http3.get;
+      const get = isSecure ? https2.get : http2.get;
       let perMessageDeflate;
       opts.createConnection = isSecure ? tlsConnect : netConnect;
       opts.defaultPort = opts.defaultPort || defaultPort;
@@ -37407,7 +37407,7 @@ var require_websocket_server = __commonJS({
     "use strict";
     init_import_meta_url();
     var EventEmitter3 = require("events");
-    var http3 = require("http");
+    var http2 = require("http");
     var https2 = require("https");
     var net3 = require("net");
     var tls = require("tls");
@@ -37443,8 +37443,8 @@ var require_websocket_server = __commonJS({
           );
         }
         if (options14.port != null) {
-          this._server = http3.createServer((req, res) => {
-            const body = http3.STATUS_CODES[426];
+          this._server = http2.createServer((req, res) => {
+            const body = http2.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -37636,7 +37636,7 @@ var require_websocket_server = __commonJS({
     __name(socketOnError, "socketOnError");
     function abortHandshake(socket, code, message, headers) {
       if (socket.writable) {
-        message = message || http3.STATUS_CODES[code];
+        message = message || http2.STATUS_CODES[code];
         headers = {
           Connection: "close",
           "Content-Type": "text/html",
@@ -37644,7 +37644,7 @@ var require_websocket_server = __commonJS({
           ...headers
         };
         socket.write(
-          `HTTP/1.1 ${code} ${http3.STATUS_CODES[code]}\r
+          `HTTP/1.1 ${code} ${http2.STATUS_CODES[code]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
         );
       }
@@ -82856,10 +82856,10 @@ var require_methods = __commonJS({
   "../../node_modules/methods/index.js"(exports2, module2) {
     "use strict";
     init_import_meta_url();
-    var http3 = require("http");
+    var http2 = require("http");
     module2.exports = getCurrentNodeMethods() || getBasicNodeMethods();
     function getCurrentNodeMethods() {
-      return http3.METHODS && http3.METHODS.map(/* @__PURE__ */ __name(function lowerCaseMethod(method) {
+      return http2.METHODS && http2.METHODS.map(/* @__PURE__ */ __name(function lowerCaseMethod(method) {
         return method.toLowerCase();
       }, "lowerCaseMethod"));
     }
@@ -86297,7 +86297,7 @@ var require_application = __commonJS({
     var query = require_query();
     var debug = require_src4()("express:application");
     var View = require_view();
-    var http3 = require("http");
+    var http2 = require("http");
     var compileETag = require_utils5().compileETag;
     var compileQueryParser = require_utils5().compileQueryParser;
     var compileTrust = require_utils5().compileTrust;
@@ -86546,7 +86546,7 @@ var require_application = __commonJS({
       tryRender(view, renderOptions, done);
     }, "render");
     app.listen = /* @__PURE__ */ __name(function listen() {
-      var server2 = http3.createServer(this);
+      var server2 = http2.createServer(this);
       return server2.listen.apply(server2, arguments);
     }, "listen");
     function logerror(err) {
@@ -87205,12 +87205,12 @@ var require_request3 = __commonJS({
     var deprecate = require_depd()("express");
     var isIP = require("net").isIP;
     var typeis = require_type_is();
-    var http3 = require("http");
+    var http2 = require("http");
     var fresh = require_fresh();
     var parseRange = require_range_parser();
     var parse5 = require_parseurl();
     var proxyaddr = require_proxy_addr();
-    var req = Object.create(http3.IncomingMessage.prototype);
+    var req = Object.create(http2.IncomingMessage.prototype);
     module2.exports = req;
     req.get = req.header = /* @__PURE__ */ __name(function header(name) {
       if (!name) {
@@ -87633,7 +87633,7 @@ var require_response2 = __commonJS({
     var deprecate = require_depd()("express");
     var encodeUrl = require_encodeurl();
     var escapeHtml = require_escape_html();
-    var http3 = require("http");
+    var http2 = require("http");
     var isAbsolute = require_utils5().isAbsolute;
     var onFinished = require_on_finished();
     var path44 = require("path");
@@ -87649,7 +87649,7 @@ var require_response2 = __commonJS({
     var mime = send.mime;
     var resolve17 = path44.resolve;
     var vary = require_vary();
-    var res = Object.create(http3.ServerResponse.prototype);
+    var res = Object.create(http2.ServerResponse.prototype);
     module2.exports = res;
     var charsetRegExp = /;\s*charset\s*=/;
     res.status = /* @__PURE__ */ __name(function status(code) {
@@ -102152,7 +102152,7 @@ var require_websocket3 = __commonJS({
     init_import_meta_url();
     var EventEmitter3 = require("events");
     var https2 = require("https");
-    var http3 = require("http");
+    var http2 = require("http");
     var net3 = require("net");
     var tls = require("tls");
     var { randomBytes, createHash } = require("crypto");
@@ -102552,7 +102552,7 @@ var require_websocket3 = __commonJS({
       }
       const defaultPort = isSecure ? 443 : 80;
       const key = randomBytes(16).toString("base64");
-      const get = isSecure ? https2.get : http3.get;
+      const get = isSecure ? https2.get : http2.get;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = isSecure ? tlsConnect : netConnect;
@@ -102936,7 +102936,7 @@ var require_websocket_server2 = __commonJS({
     "use strict";
     init_import_meta_url();
     var EventEmitter3 = require("events");
-    var http3 = require("http");
+    var http2 = require("http");
     var https2 = require("https");
     var net3 = require("net");
     var tls = require("tls");
@@ -102975,8 +102975,8 @@ var require_websocket_server2 = __commonJS({
           );
         }
         if (options14.port != null) {
-          this._server = http3.createServer((req, res) => {
-            const body = http3.STATUS_CODES[426];
+          this._server = http2.createServer((req, res) => {
+            const body = http2.STATUS_CODES[426];
             res.writeHead(426, {
               "Content-Length": body.length,
               "Content-Type": "text/plain"
@@ -103203,7 +103203,7 @@ var require_websocket_server2 = __commonJS({
     __name(socketOnError, "socketOnError");
     function abortHandshake(socket, code, message, headers) {
       if (socket.writable) {
-        message = message || http3.STATUS_CODES[code];
+        message = message || http2.STATUS_CODES[code];
         headers = {
           Connection: "close",
           "Content-Type": "text/html",
@@ -103211,7 +103211,7 @@ var require_websocket_server2 = __commonJS({
           ...headers
         };
         socket.write(
-          `HTTP/1.1 ${code} ${http3.STATUS_CODES[code]}\r
+          `HTTP/1.1 ${code} ${http2.STATUS_CODES[code]}\r
 ` + Object.keys(headers).map((h) => `${h}: ${headers[h]}`).join("\r\n") + "\r\n\r\n" + message
         );
       }
@@ -126541,14 +126541,14 @@ var import_undici16 = __toESM(require_undici());
 
 // src/dev-registry.ts
 init_import_meta_url();
-var import_http = __toESM(require("http"));
 var import_net = __toESM(require("net"));
+var import_node_http = require("node:http");
 var import_body_parser = __toESM(require_body_parser());
 var import_express = __toESM(require_express2());
 var import_http_terminator = __toESM(require_src7());
 var import_undici = __toESM(require_undici());
-var DEV_REGISTRY_PORT = "6284";
-var DEV_REGISTRY_HOST = `http://localhost:${DEV_REGISTRY_PORT}`;
+var DEV_REGISTRY_PORT = 6284;
+var DEV_REGISTRY_HOST = `http://127.0.0.1:${DEV_REGISTRY_PORT}`;
 var server;
 var terminator;
 async function isPortAvailable() {
@@ -126564,7 +126564,7 @@ async function isPortAvailable() {
       netServer.close();
       resolve17(true);
     });
-    netServer.listen(DEV_REGISTRY_PORT);
+    netServer.listen(DEV_REGISTRY_PORT, "127.0.0.1");
   });
 }
 __name(isPortAvailable, "isPortAvailable");
@@ -126585,9 +126585,9 @@ async function startWorkerRegistry() {
       workers = {};
       res.json(null);
     });
-    server = import_http.default.createServer(app);
+    server = (0, import_node_http.createServer)(app);
     terminator = (0, import_http_terminator.createHttpTerminator)({ server });
-    server.listen(DEV_REGISTRY_PORT);
+    server.listen(DEV_REGISTRY_PORT, "127.0.0.1");
     server.once("error", (err) => {
       if (err.code !== "EADDRINUSE") {
         throw err;
@@ -128788,7 +128788,7 @@ var import_websocket_server = __toESM(require_websocket_server2(), 1);
 var wrapper_default = import_websocket.default;
 
 // package.json
-var version = "2.20.1";
+var version = "2.20.2";
 var package_default = {
   name: "wrangler",
   version,
@@ -128911,7 +128911,7 @@ var package_default = {
     "@cloudflare/workers-types": "^4.20221111.1",
     "@iarna/toml": "^3.0.0",
     "@microsoft/api-extractor": "^7.28.3",
-    "@miniflare/tre": "3.0.0-next.13",
+    "@miniflare/tre": "3.0.0-next.14",
     "@types/better-sqlite3": "^7.6.0",
     "@types/busboy": "^1.5.0",
     "@types/command-exists": "^1.2.0",
@@ -128992,8 +128992,8 @@ var package_default = {
 
 // src/proxy.ts
 init_import_meta_url();
-var import_node_http = require("node:http");
-var import_node_http2 = require("node:http2");
+var import_node_http2 = require("node:http");
+var import_node_http22 = require("node:http2");
 var import_node_https = require("node:https");
 var import_node_https2 = __toESM(require("node:https"));
 var import_node_os5 = require("node:os");
@@ -129425,7 +129425,7 @@ function configureProxyServer({
   }
   const cleanupListeners = [];
   logger.debug("PREVIEW URL:", `https://${previewToken.host}`);
-  const remote = (0, import_node_http2.connect)(`https://${previewToken.host}`);
+  const remote = (0, import_node_http22.connect)(`https://${previewToken.host}`);
   cleanupListeners.push(() => remote.destroy());
   remote.on("close", retryServerSetup);
   cleanupListeners.push(() => remote.off("close", retryServerSetup));
@@ -129558,7 +129558,7 @@ var HTTP1_HEADERS = /* @__PURE__ */ new Set([
   "http2-settings"
 ]);
 async function createProxyServer(localProtocol) {
-  const server2 = localProtocol === "https" ? (0, import_node_https.createServer)(await getHttpsOptions()) : (0, import_node_http.createServer)();
+  const server2 = localProtocol === "https" ? (0, import_node_https.createServer)(await getHttpsOptions()) : (0, import_node_http2.createServer)();
   return server2.on("upgrade", (req) => {
     logger.log(
       new Date().toLocaleTimeString(),
@@ -129620,7 +129620,7 @@ async function waitForPortToBeAvailable(port2, options14) {
         doResolve();
         return;
       }
-      const server2 = (0, import_node_http.createServer)();
+      const server2 = (0, import_node_http2.createServer)();
       const terminator2 = (0, import_http_terminator2.createHttpTerminator)({
         server: server2,
         gracefulTerminationTimeout: 0
@@ -129655,6 +129655,48 @@ function getAccessibleHosts2() {
 __name(getAccessibleHosts2, "getAccessibleHosts");
 
 // src/inspect.ts
+var ALLOWED_HOST_HOSTNAMES = ["127.0.0.1", "[::1]", "localhost"];
+var ALLOWED_ORIGIN_HOSTNAMES = [
+  "devtools.devprod.cloudflare.dev",
+  "cloudflare-devtools.pages.dev",
+  /^[a-z0-9]+\.cloudflare-devtools\.pages\.dev$/,
+  "127.0.0.1",
+  "[::1]",
+  "localhost"
+];
+function validateWebSocketHandshake(req) {
+  const hostHeader = req.headers.host;
+  if (hostHeader == null)
+    return false;
+  try {
+    const host = new import_node_url6.URL(`http://${hostHeader}`);
+    if (!ALLOWED_HOST_HOSTNAMES.includes(host.hostname))
+      return false;
+  } catch {
+    return false;
+  }
+  let originHeader = req.headers.origin;
+  if (originHeader === null && req.headers["user-agent"] === void 0) {
+    originHeader = "http://localhost";
+  }
+  if (originHeader == null)
+    return false;
+  try {
+    const origin = new import_node_url6.URL(originHeader);
+    const allowed = ALLOWED_ORIGIN_HOSTNAMES.some((rule) => {
+      if (typeof rule === "string")
+        return origin.hostname === rule;
+      else
+        return rule.test(origin.hostname);
+    });
+    if (!allowed)
+      return false;
+  } catch {
+    return false;
+  }
+  return true;
+}
+__name(validateWebSocketHandshake, "validateWebSocketHandshake");
 function useInspector(props) {
   const inspectorIdRef = (0, import_react2.useRef)(randomId());
   const [localWebSocket, setLocalWebSocket] = (0, import_react2.useState)();
@@ -129677,7 +129719,7 @@ function useInspector(props) {
           case "/json/list":
             {
               res.setHeader("Content-Type", "application/json");
-              const localHost = `localhost:${props.port}/ws`;
+              const localHost = `127.0.0.1:${props.port}/ws`;
               const devtoolsFrontendUrl = `devtools://devtools/bundled/js_app.html?experiments=true&v8only=true&ws=${localHost}`;
               const devtoolsFrontendUrlCompat = `devtools://devtools/bundled/inspector.html?experiments=true&v8only=true&ws=${localHost}`;
               res.end(
@@ -129712,7 +129754,11 @@ function useInspector(props) {
     });
   }
   const wsServer = wsServerRef.current;
-  wsServer.on("connection", (ws) => {
+  wsServer.on("connection", (ws, req) => {
+    if (!validateWebSocketHandshake(req)) {
+      ws.close(1008, "Unauthorised");
+      return;
+    }
     if (wsServer.clients.size > 1) {
       logger.error(
         "Tried to open a new devtools window when a previous one was already open."
@@ -129739,7 +129785,7 @@ function useInspector(props) {
         timeout: 2e3,
         abortSignal: abortController.signal
       });
-      server2.listen(props.port);
+      server2.listen(props.port, "127.0.0.1");
     }
     __name(startInspectorProxy, "startInspectorProxy");
     startInspectorProxy().catch((err) => {
@@ -130162,7 +130208,7 @@ __name(logConsoleMessage, "logConsoleMessage");
 var openInspector = /* @__PURE__ */ __name(async (inspectorPort, worker) => {
   const query = new URLSearchParams();
   query.set("theme", "systemPreferred");
-  query.set("ws", `localhost:${inspectorPort}/ws`);
+  query.set("ws", `127.0.0.1:${inspectorPort}/ws`);
   if (worker)
     query.set("domain", worker);
   const url3 = `https://devtools.devprod.cloudflare.dev/js_app?${query.toString()}`;
@@ -132348,7 +132394,7 @@ async function transformMf2OptionsToMf3Options({
 __name(transformMf2OptionsToMf3Options, "transformMf2OptionsToMf3Options");
 var miniflare3Module;
 async function getMiniflare3() {
-  return miniflare3Module ??= await npxImport("@miniflare/tre@3.0.0-next.13");
+  return miniflare3Module ??= await npxImport("@miniflare/tre@3.0.0-next.14");
 }
 __name(getMiniflare3, "getMiniflare3");