oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add origin validation to websocket connections

Browse source
This commit is contained in:
shortcutme 2019-08-18 03:03:02 +02:00
parent 7d1ca3862d
commit b871849df4
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/Ui/UiRequest.py
View file

@ -712,9 +712,19 @@ class UiRequest(object):
# On websocket connection # On websocket connection
def actionWebsocket(self): def actionWebsocket(self):
ws = self.env.get("wsgi.websocket") ws = self.env.get("wsgi.websocket")
if ws: if ws:
wrapper_key = self.get["wrapper_key"] # Allow only same-origin websocket requests
origin = self.env.get("HTTP_ORIGIN")
host = self.env.get("HTTP_HOST")
if origin and host:
origin_host = origin.split("://", 1)[-1]
if host != origin_host:
ws.send(json.dumps({"error": "Invalid origin: %s" % origin}))
return self.error403("Invalid origin: %s" % origin)
# Find site by wrapper_key # Find site by wrapper_key
wrapper_key = self.get["wrapper_key"]
site = None site = None
for site_check in list(self.server.sites.values()): for site_check in list(self.server.sites.values()):
if site_check.settings["wrapper_key"] == wrapper_key: if site_check.settings["wrapper_key"] == wrapper_key: