Archives/gristlabs_grist-core
1
0
Fork 0
mirror of https://github.com/gristlabs/grist-core.git synced 2024-10-27 20:44:07 +00:00
Code Issues Projects Releases Wiki Activity

Use url.hostname instead of url.host to allow host from environment variable (#326)

Browse Source 
Co-authored-by <yohan.boniface@free.fr>
This commit is contained in:
Louis Delbosc 2022-10-25 20:59:17 +02:00 committed by GitHub
parent caef8bae22
commit eea2ef5cfb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/server/lib/requestUtils.ts
View File

@ -117,7 +117,7 @@ export function matchesBaseDomain(domain: string, baseDomain: string) {
}
export function isEnvironmentAllowedHost(url: string|URL) {
const urlHost = (typeof url === 'string') ? url : url.host;
const urlHost = (typeof url === 'string') ? url : url.hostname;
return (process.env.GRIST_ALLOWED_HOSTS || "").split(",").some(domain =>
domain && matchesBaseDomain(urlHost, domain)
);

3
test/server/lib/DocApi.ts
View File

@ -3035,6 +3035,7 @@ function testDocApi() {
await checkOrigin("https://www.toto.com", 403, "Unrecognized origin");
await checkOrigin("https://badexample.com", 403, "Unrecognized origin");
await checkOrigin("https://bad.com/example.com/toto", 403, "Unrecognized origin");
await checkOrigin("https://example.com:3000/path", 200);
await checkOrigin("https://example.com/path", 200);
await checkOrigin("https://good.example.com/toto", 200);
});
@ -3133,7 +3134,7 @@ class TestServer {
REDIS_URL: process.env.TEST_REDIS_URL,
APP_HOME_URL: _homeUrl,
ALLOWED_WEBHOOK_DOMAINS: `example.com,localhost:${webhooksTestPort}`,
GRIST_ALLOWED_HOSTS: `example.com,localhost:${webhooksTestPort}`,
GRIST_ALLOWED_HOSTS: `example.com,localhost`,
...process.env
};