fix security vuln (#1794)

parcel-bundler · Sep 25, 2018 · 066e0bf · 066e0bf
1 parent 948159b
commit 066e0bf
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/packages/core/parcel-bundler/src/HMRServer.js b/packages/core/parcel-bundler/src/HMRServer.js
@@ -17,7 +17,17 @@ class HMRServer {
         this.server = https.createServer(await getCertificate(options.https));
       }
 
-      this.wss = new WebSocket.Server({server: this.server});
+      let websocketOptions = {
+        server: this.server
+      };
+
+      if (options.hmrHostname) {
+        websocketOptions.origin = `${options.https ? 'https' : 'http'}://${
+          options.hmrHostname
+        }`;
+      }
+
+      this.wss = new WebSocket.Server(websocketOptions);
       this.server.listen(options.hmrPort, resolve);
     });