Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
admin: Disallow websockets
No currently-known exploit here, just being conservative
Matthew Holt committed
May 21, 2020 at 12:29 UTC
1dc4ec2d77f6f239f4c17e8ba754e71655796a4d
1 file changed
+8
admin.go
+8
@@ -299,6 +299,14 @@ func (h adminHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
299
// be called more than once per request, for example if a request
300
// is rewritten (i.e. internal redirect).
301
func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
302
+ if strings.Contains(r.Header.Get("Upgrade"), "websocket") {
303
+ // I've never been able demonstrate a vulnerability myself, but apparently
304
+ // WebSocket connections originating from browsers aren't subject to CORS
305
+ // restrictions, so we'll just be on the safe side
306
+ h.handleError(w, r, fmt.Errorf("websocket connections aren't allowed"))
307
+ return
308
+ }
309
+
310
if h.enforceHost {
311
// DNS rebinding mitigation
312
err := h.checkHost(r)