MDS/openide
1
0
Fork 0
mirror of https://gitflic.ru/project/openide/openide.git synced 2026-09-27 10:03:11 +07:00
Code Issues Packages Projects Releases Wiki Activity

check Host

Browse Source
This commit is contained in:
Vladimir Krivosheev
2016-04-22 15:16:44 +02:00
parent 2c49382630
commit 63bf42b6ab
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/platform-impl/src/org/jetbrains/ide/HttpRequestHandler.java
+5 -1
View File
@@ -43,8 +43,12 @@ public abstract class HttpRequestHandler {
return false;
}
@SuppressWarnings("SpellCheckingInspection")
public boolean isAccessible(@NotNull HttpRequest request) {
return NettyKt.isLocalOrigin(request);
String host = NettyKt.getHost(request);
// If attacker.com DNS rebound to 127.0.0.1 and user open site directly — no Origin or Referer headers.
// So we should check Host header.
return host != null && NettyKt.isLocalOrigin(request) && NettyKt.parseAndCheckIsLocalHost(host);
}
public boolean isSupported(@NotNull FullHttpRequest request) {
platform/platform-impl/src/org/jetbrains/io/netty.kt
+2 -1
View File
@@ -153,7 +153,8 @@ private fun isTrustedChromeExtension(uri: URI): Boolean {
return uri.scheme == "chrome-extension" && (uri.host == "hmhgeddbohgjknpmjagkdomcpobmllji" || uri.host == "offnedcbhjldheanlbojaefbfbllddna")
}
private fun parseAndCheckIsLocalHost(uri: String?, onlyAnyOrLoopback: Boolean): Boolean {
@JvmOverloads
fun parseAndCheckIsLocalHost(uri: String?, onlyAnyOrLoopback: Boolean = true): Boolean {
if (uri == null) {
return true
}