fix: faulty serving web pages with images when the host was an IPv6 address
Massimo Melina committed
Aug 7, 2025 at 15:35 UTC
b12af062ca5cfb8d4233769ed153bdbc7699e5d9
1 file changed
+3
-3
src/serveFile.ts
+3
-3
@@ -7,7 +7,7 @@ import { HTTP_BAD_REQUEST, HTTP_FORBIDDEN, HTTP_METHOD_NOT_ALLOWED, HTTP_NO_CONT
7
import { getNodeName, VfsNode } from './vfs'
8
import mimetypes from 'mime-types'
9
import { defineConfig } from './config'
10
-import { CFG, Dict, makeMatcher, matches, normalizeHost, with_ } from './misc'
10
+import { CFG, Dict, makeMatcher, matches, normalizeHost, try_, with_ } from './misc'
11
import _ from 'lodash'
12
import { basename } from 'path'
13
import { promisify } from 'util'
@@ -43,8 +43,8 @@ export async function serveFileNode(ctx: Koa.Context, node: VfsNode) {
43
const mimeString = typeof mime === 'string' ? mime
44
: _.find(mime, (val,mask) => matches(name, mask))
45
if (allowedReferer.get()) {
46
- const ref = /\/\/([^:/]+)/.exec(ctx.get('referer'))?.[1] // extract host from url
47
- if (ref && ref !== normalizeHost(ctx.host) // automatically accept if referer is basically the hosting domain
46
+ const ref = try_(() => new URL(ctx.get('referer')||'').host)
47
+ if (ref && ref !== ctx.host // automatically accept if referer is basically the hosting domain
48
&& !matches(ref, allowedReferer.get()))
49
return ctx.status = HTTP_FORBIDDEN
50
}