Reject every non-loopback runtime listener

2026-08-13 20:59:30 +02:00
parent e58a38a915
commit 4b7011131d
3 changed files with 20 additions and 53 deletions
@@ -21,7 +21,12 @@ class RemoteServer {
    return new Promise((resolve, reject) => {
      this._config = opts;

-      const wssOpts = { port: opts.port, host: opts.host || '127.0.0.1', maxPayload: 256 * 1024 };
+      const host = opts.host || '127.0.0.1';
+      if (host !== '127.0.0.1' && host !== '::1') {
+        reject(new Error('Remote server requires a loopback host'));
+        return;
+      }
+      const wssOpts = { port: opts.port, host, maxPayload: 256 * 1024 };
      this._wss = new WebSocketServer(wssOpts, () => {
        resolve();
      });