mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
729252008b
Adversarial review of the peer-IP fix surfaced: (1) CRITICAL — cliTokenAuth.ts
still derived loopback from new URL(request.url).hostname (the same spoofable
Host class), letting a remote caller with a stolen CLI token reach management
APIs via Host: 127.0.0.1; now it trusts the middleware-stamped locality verdict
(AUTHZ_HEADER_PEER_LOCALITY, a client-stripped trusted header). (2) HIGH —
isLoopbackHost mangled bare IPv6 (::1, ::ffff:127.0.0.1) via split(":")[0],
a fail-closed DoS on IPv6 deploys. (3) HIGH — the Docker entrypoint ran bare
server.js (no peer stamp); run-standalone.mjs now prefers server-ws.mjs.
25 lines
873 B
JavaScript
25 lines
873 B
JavaScript
#!/usr/bin/env node
|
|
|
|
import { existsSync } from "node:fs";
|
|
import {
|
|
resolveRuntimePorts,
|
|
withRuntimePortEnv,
|
|
spawnWithForwardedSignals,
|
|
} from "../build/runtime-env.mjs";
|
|
import { bootstrapEnv } from "../build/bootstrap-env.mjs";
|
|
|
|
const env = bootstrapEnv();
|
|
const runtimePorts = resolveRuntimePorts(env);
|
|
|
|
// Prefer the WS-aware wrapper (server-ws.mjs) over the bare Next standalone
|
|
// server.js: it installs the trusted peer-IP stamp (scripts/dev/peer-stamp.mjs)
|
|
// that the authz middleware needs to allow loopback/LAN access to LOCAL_ONLY
|
|
// routes. Falling back to server.js fails CLOSED (every LOCAL_ONLY request 403s)
|
|
// rather than trusting the spoofable Host header.
|
|
const entry = existsSync("server-ws.mjs") ? "server-ws.mjs" : "server.js";
|
|
|
|
spawnWithForwardedSignals("node", [entry], {
|
|
stdio: "inherit",
|
|
env: withRuntimePortEnv(env, runtimePorts),
|
|
});
|