fix URL phasing again #7735
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Apr 1, 2026 at 22:07 UTC
d715acc7fd505c8de11d395a50d99cd326c27854
4 files changed
+6
-5
meshipkvm.js
+1
-1
@@ -262,7 +262,7 @@ function CreateIPKVMManager(parent) {
262
263
// Parse an incoming HTTP request URL
264
function parseIpKvmUrl(domain, url) {
265
- const q = new URL(url);
265
+ const q = new URL(url, 'http://localhost');
266
const i = q.pathname.indexOf('/ipkvm.ashx/');
267
if (i == -1) return null;
268
const urlargs = q.pathname.substring(i + 12).split('/');
meshuser.js
+1
-1
@@ -994,7 +994,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
994
if (command.type == 'tunnel') {
995
if ((typeof command.value != 'string') || (typeof command.nodeid != 'string')) break;
996
var url = null;
997
- try { url = new URL(command.value); } catch (ex) { }
997
+ try { url = new URL(command.value, 'http://localhost'); } catch (ex) { }
998
if (url == null) break; // Bad URL
999
if (url.searchParams.get('nodeid') && (url.searchParams.get('nodeid') != command.nodeid)) break; // Bad NodeID in URL query string
1000
pluginHandler.js
+2
-1
@@ -251,7 +251,8 @@ module.exports.pluginHandler = function (parent) {
251
return new Promise(function (resolve, reject) {
252
var http = (configUrl.indexOf('https://') >= 0) ? require('https') : require('http');
253
if (configUrl.indexOf('://') === -1) reject("Unable to fetch the config: Bad URL (" + configUrl + ")");
254
- var options = new URL(configUrl);
254
+ const getme = new URL(configUrl);
255
+ var options = { protocol: getme.protocol, hostname: getme.hostname, port: getme.port || undefined, path: getme.pathname + getme.search };
256
if (typeof parent.config.settings.plugins.proxy == 'string' || process.env['HTTP_PROXY'] || process.env['HTTPS_PROXY'] || process.env['http_proxy'] || process.env['https_proxy']) { // Proxy support
257
options.agent = new (require('https-proxy-agent').HttpsProxyAgent)(new URL(parent.config.settings.plugins.proxy) || process.env['HTTP_PROXY'] || process.env['HTTPS_PROXY'] || process.env['http_proxy'] || process.env['https_proxy']);
258
}
webserver.js
+2
-2
@@ -6439,8 +6439,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
6439
obj.CheckWebServerOriginName = function (domain, req) {
6440
if (domain.allowedorigin === true) return true; // Ignore origin
6441
if (typeof req.headers.origin != 'string') return true; // No origin in the header, this is a desktop app
6442
- const originUrl = new URL(req.headers.origin);
6443
- if (typeof originUrl.hostname != 'string') return false; // Origin hostname is not valid
6442
+ let originUrl; try { originUrl = new URL(req.headers.origin); } catch (ex) { return false; }
6443
+ if (!originUrl.hostname) return false; // Origin hostname is not valid
6444
if (Array.isArray(domain.allowedorigin)) return (domain.allowedorigin.indexOf(originUrl.hostname) >= 0); // Check if this is an allowed origin from an explicit list
6445
if (obj.isTrustedCert(domain) === false) return true; // This server does not have a trusted certificate.
6446
if (domain.dns != null) return (domain.dns == originUrl.hostname); // Match the domain DNS