File size: 2,123 Bytes
c120a1c |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 |
import path from 'node:path';
import { color, getConfigValue, safeReadFileSync } from '../util.js';
import { serverDirectory } from '../server-directory.js';
import { isHostAllowed, hostValidationMiddleware } from 'host-validation-middleware';
const knownHosts = new Set();
const maxKnownHosts = 1000;
const hostWhitelistEnabled = !!getConfigValue('hostWhitelist.enabled', false);
const hostWhitelist = Object.freeze(getConfigValue('hostWhitelist.hosts', []));
const hostWhitelistScan = !!getConfigValue('hostWhitelist.scan', false, 'boolean');
const hostNotAllowedHtml = safeReadFileSync(path.join(serverDirectory, 'public/error/host-not-allowed.html'))?.toString() ?? '';
const validationMiddleware = hostValidationMiddleware({
allowedHosts: hostWhitelist,
generateErrorMessage: () => hostNotAllowedHtml,
errorResponseContentType: 'text/html',
});
/**
* Middleware to validate remote hosts.
* Useful to protect against DNS rebinding attacks.
* @param {import('express').Request} req Request
* @param {import('express').Response} res Response
* @param {import('express').NextFunction} next Next middleware
*/
export default function hostWhitelistMiddleware(req, res, next) {
const hostValue = req.headers.host;
if (hostWhitelistScan && !isHostAllowed(hostValue, hostWhitelist) && !knownHosts.has(hostValue) && knownHosts.size < maxKnownHosts) {
const isFirstWarning = knownHosts.size === 0;
console.warn(color.red('Request from untrusted host:'), hostValue);
console.warn(`If you trust this host, you can add it to ${color.yellow('hostWhitelist.hosts')} in config.yaml`);
if (!hostWhitelistEnabled && isFirstWarning) {
console.warn(`To protect against host spoofing, consider setting ${color.yellow('hostWhitelist.enabled')} to true`);
}
if (isFirstWarning) {
console.warn(`To disable this warning, set ${color.yellow('hostWhitelist.scan')} to false`);
}
knownHosts.add(hostValue);
}
if (!hostWhitelistEnabled) {
return next();
}
return validationMiddleware(req, res, next);
}
|