From eea2ef5cfb4fb4ee975a1e85414edea5394765f1 Mon Sep 17 00:00:00 2001 From: Louis Delbosc Date: Tue, 25 Oct 2022 20:59:17 +0200 Subject: [PATCH] Use url.hostname instead of url.host to allow host from environment variable (#326) Co-authored-by --- app/server/lib/requestUtils.ts | 2 +- test/server/lib/DocApi.ts | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/app/server/lib/requestUtils.ts b/app/server/lib/requestUtils.ts index 34c93d2e..ab7243e3 100644 --- a/app/server/lib/requestUtils.ts +++ b/app/server/lib/requestUtils.ts @@ -117,7 +117,7 @@ export function matchesBaseDomain(domain: string, baseDomain: string) { } export function isEnvironmentAllowedHost(url: string|URL) { - const urlHost = (typeof url === 'string') ? url : url.host; + const urlHost = (typeof url === 'string') ? url : url.hostname; return (process.env.GRIST_ALLOWED_HOSTS || "").split(",").some(domain => domain && matchesBaseDomain(urlHost, domain) ); diff --git a/test/server/lib/DocApi.ts b/test/server/lib/DocApi.ts index 9e6af838..0ec6feaa 100644 --- a/test/server/lib/DocApi.ts +++ b/test/server/lib/DocApi.ts @@ -3035,6 +3035,7 @@ function testDocApi() { await checkOrigin("https://www.toto.com", 403, "Unrecognized origin"); await checkOrigin("https://badexample.com", 403, "Unrecognized origin"); await checkOrigin("https://bad.com/example.com/toto", 403, "Unrecognized origin"); + await checkOrigin("https://example.com:3000/path", 200); await checkOrigin("https://example.com/path", 200); await checkOrigin("https://good.example.com/toto", 200); }); @@ -3133,7 +3134,7 @@ class TestServer { REDIS_URL: process.env.TEST_REDIS_URL, APP_HOME_URL: _homeUrl, ALLOWED_WEBHOOK_DOMAINS: `example.com,localhost:${webhooksTestPort}`, - GRIST_ALLOWED_HOSTS: `example.com,localhost:${webhooksTestPort}`, + GRIST_ALLOWED_HOSTS: `example.com,localhost`, ...process.env };