fix: handle malformed referer
Massimo Melina committed
Jun 12, 2024 at 11:23 UTC
87e1d13cb4e7c41eb7eb135e75a1a285885425e8
2 files changed
+6
-8
src/roots.ts
+3
-4
@@ -1,5 +1,5 @@
1
import { defineConfig, getConfig } from './config'
2
-import { ADMIN_URI, API_URI, Callback, CFG, isLocalHost, join, makeMatcher, removeStarting, SPECIAL_URI } from './misc'
2
+import { ADMIN_URI, API_URI, Callback, CFG, isLocalHost, join, makeMatcher, removeStarting, SPECIAL_URI, try_ } from './misc'
3
import Koa from 'koa'
4
import { disconnect } from './connections'
5
import { baseUrl } from './listen'
@@ -25,9 +25,8 @@ export const rootsMiddleware: Koa.Middleware = (ctx, next) =>
25
if (!ctx.path.startsWith(API_URI)) return // ...unless it's an api
26
params = ctx.state.params || ctx.query // for api we'll translate params
27
changeUriParams(v => removeStarting(ctx.state.revProxyPath, v)) // removal must be done before adding the root
28
- let { referer } = ctx.headers
29
- referer &&= new URL(referer).pathname
30
- if (referer?.startsWith(ctx.state.revProxyPath + ADMIN_URI)) return // exclude apis for admin-panel
28
+ const { referer } = ctx.headers
29
+ if (referer && try_(() => new URL(referer).pathname.startsWith(ctx.state.revProxyPath + ADMIN_URI))) return // exclude apis for admin-panel
30
}
31
if (_.isEmpty(roots.get())) return
32
const root = roots.compiled()?.(ctx.host)
src/serveGuiAndSharedFiles.ts
+3
-4
@@ -15,7 +15,7 @@ import { allowAdmin, favicon } from './adminApis'
15
import { serveGuiFiles } from './serveGuiFiles'
16
import mount from 'koa-mount'
17
import { baseUrl } from './listen'
18
-import { asyncGeneratorToReadable, deleteNode, filterMapGenerator, pathEncode } from './misc'
18
+import { asyncGeneratorToReadable, deleteNode, filterMapGenerator, pathEncode, try_ } from './misc'
19
import { basicWeb, detectBasicAgent } from './basicWeb'
20
21
const serveFrontendFiles = serveGuiFiles(process.env.FRONTEND_PROXY, FRONTEND_URI)
@@ -27,9 +27,8 @@ export const serveGuiAndSharedFiles: Koa.Middleware = async (ctx, next) => {
27
const { path } = ctx
28
// dynamic import on frontend|admin (used for non-https login) while developing (vite4) is not producing a relative path
29
if (DEV && path.startsWith('/node_modules/')) {
30
- let { referer } = ctx.headers
31
- referer &&= new URL(referer).pathname
32
- return referer?.startsWith(ADMIN_URI) ? serveAdminFiles(ctx, next)
30
+ const { referer: r } = ctx.headers
31
+ return try_(() => r && new URL(r).pathname?.startsWith(ADMIN_URI)) ? serveAdminFiles(ctx, next)
32
: serveFrontendFiles(ctx, next)
33
}
34
if (path.startsWith(FRONTEND_URI))