prevent DNS-rebinding attacks
Massimo Melina committed
Jun 17, 2026 at 10:26 UTC
487b18888a3460a49d0706954ec6bb817a605630
2 files changed
+2
src/adminApis.ts
+1
@@ -215,6 +215,7 @@ export function ctxAdminAccess(ctx: Koa.Context) {
215
return false
216
// whenProxyDetected covers both trusted and misconfigured proxies, so localhost_admin never trusts proxied localhost claims
217
return !ctx.state.whenProxyDetected && localhostAdmin.get() && isLocalHost(ctx)
218
+ && /^(?:|localhost|127\.0\.0\.1|\[::1])(?::\d+)?$/i.test(ctx.get('host')) // check Host to avoid DNS-rebinding attacks
219
|| ctx.state.account && accountCanLoginAdmin(ctx.state.account)
220
}
221
src/cross.ts
+1
@@ -448,6 +448,7 @@ export function xlate(input: any, table: Record<string, any>) {
448
return table[input] ?? input
449
}
450
451
+// remove brackets and port (if any)
452
export function normalizeHost(host: string) {
453
return host[0] === '[' ? host.slice(1, host.indexOf(']')) : host?.split(':')[0]
454
}