fixes parcel-bundler#1794, makes the websocket server validate the or…

…igin
carlosgeos · Jan 1, 2019 · 8231917 · 8231917
1 parent d04192b
commit 8231917
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/packages/core/parcel-bundler/src/HMRServer.js b/packages/core/parcel-bundler/src/HMRServer.js
@@ -17,15 +17,13 @@ class HMRServer {
       }
 
       let websocketOptions = {
-        server: this.server
+        server: this.server,
+        verifyClient: (info) => {
+          const originator = new URL(info.origin);
+          return options.hmrHostname === originator.hostname;
+        }
       };
 
-      if (options.hmrHostname) {
-        websocketOptions.origin = `${options.https ? 'https' : 'http'}://${
-          options.hmrHostname
-        }`;
-      }
-
       this.wss = new WebSocket.Server(websocketOptions);
       this.server.listen(options.hmrPort, resolve);
     });

diff --git a/packages/core/parcel-bundler/src/cli.js b/packages/core/parcel-bundler/src/cli.js
@@ -214,6 +214,7 @@ async function bundle(main, command) {
 
   command.throwErrors = false;
   command.scopeHoist = command.experimentalScopeHoisting || false;
+  command.hmrHostname = command.hmrHostname || 'localhost';
   const bundler = new Bundler(main, command);
 
   command.target = command.target || 'browser';