Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security fix 1794. WS server missing Origin validation. #2494

Closed
wants to merge 6 commits into from
Closed

Security fix 1794. WS server missing Origin validation. #2494

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8231917
fixes #1794, makes the websocket server validate the origin
Jan 1, 2019
c1d187e
adapt some tests for commit fixing #1794
Jan 2, 2019
8411254
no more breaking changes for #2494
Jan 3, 2019
243274f
Merge branch 'master' into security-fix-1794
DeMoorJasper Feb 8, 2019
4f1e289
Merge branch 'master' into security-fix-1794
DeMoorJasper Feb 8, 2019
5e7880c
Merge branch 'master' into security-fix-1794
DeMoorJasper Mar 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
61 changes: 44 additions & 17 deletions packages/core/integration-tests/test/hmr.js
View file
Open in desktop
Expand Up @@ -48,14 +48,17 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
await b.bundle();

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});

const buildEnd = nextEvent(b, 'buildEnd');
await sleep(100);

fs.writeFile(
path.join(__dirname, '/input/local.js'),
'exports.a = 5;\nexports.b = 5;'
Expand All @@ -79,6 +82,7 @@ describe('hmr', function() {
b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true,
hmrHostname: 'localhost',
target: 'node'
});
await b.bundle();
Expand All @@ -103,7 +107,9 @@ describe('hmr', function() {
});
await b.bundle();

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});

const buildEnd = nextEvent(b, 'buildEnd');

Expand All @@ -130,11 +136,14 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
await b.bundle();

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});

const buildEnd = nextEvent(b, 'buildEnd');

Expand All @@ -159,11 +168,14 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
await b.bundle();

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});

const buildEnd = nextEvent(b, 'buildEnd');

Expand Down Expand Up @@ -198,7 +210,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
await b.bundle();

Expand All @@ -210,7 +223,9 @@ describe('hmr', function() {
await nextEvent(b, 'buildEnd');
await sleep(50);

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});
let msg = JSON.parse(await nextEvent(ws, 'message'));
assert.equal(msg.type, 'error');
});
Expand All @@ -223,11 +238,14 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
await b.bundle();

ws = new WebSocket('ws://localhost:' + b.options.hmrPort);
ws = new WebSocket('ws://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234'
});

const firstBuildEnd = nextEvent(b, 'buildEnd');

Expand Down Expand Up @@ -264,7 +282,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
let bundle = await b.bundle();
let outputs = [];
Expand Down Expand Up @@ -295,7 +314,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
let bundle = await b.bundle();
let outputs = [];
Expand Down Expand Up @@ -336,7 +356,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
let bundle = await b.bundle();
let outputs = [];
Expand Down Expand Up @@ -369,7 +390,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
let bundle = await b.bundle();

Expand Down Expand Up @@ -410,7 +432,8 @@ describe('hmr', function() {

b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true
hmr: true,
hmrHostname: 'localhost'
});
let bundle = await b.bundle();

Expand Down Expand Up @@ -468,11 +491,13 @@ describe('hmr', function() {
b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true,
hmrHostname: 'localhost',
https: true
});
await b.bundle();

ws = new WebSocket('wss://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234',
rejectUnauthorized: false
});

Expand Down Expand Up @@ -502,6 +527,7 @@ describe('hmr', function() {
b = bundler(path.join(__dirname, '/input/index.js'), {
watch: true,
hmr: true,
hmrHostname: 'localhost',
https: {
key: path.join(__dirname, '/integration/https/private.pem'),
cert: path.join(__dirname, '/integration/https/primary.crt')
Expand All @@ -510,6 +536,7 @@ describe('hmr', function() {
await b.bundle();

ws = new WebSocket('wss://localhost:' + b.options.hmrPort, {
origin: 'http://localhost:1234',
rejectUnauthorized: false
});

Expand Down
7 changes: 4 additions & 3 deletions packages/core/parcel-bundler/src/HMRServer.js
View file
Open in desktop
Expand Up @@ -21,9 +21,10 @@ class HMRServer {
};

if (options.hmrHostname) {
websocketOptions.origin = `${options.https ? 'https' : 'http'}://${
options.hmrHostname
}`;
websocketOptions.verifyClient = info => {
const originator = new URL(info.origin);
return options.hmrHostname === originator.hostname;
};
}

this.wss = new WebSocket.Server(websocketOptions);
Expand Down