Buriburizaemon/nodewarden
1
0
Fork 0
mirror of https://github.com/shuaiplus/nodewarden.git synced 2026-08-05 23:00:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden backup blob and remote endpoint handling

Browse Source
This commit is contained in:
shuaiplus
2026-07-06 18:17:55 +08:00
parent 7ac6ae50bb
commit 5c8f01be59
5 changed files with 84 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/services/backup-config.ts
+16 -1
View File
@@ -124,11 +124,26 @@ function assertBackupEndpointHostAllowed(hostname: string, label: string): void
if (!normalized) throw new Error(`${label} host is required`);
if (
normalized === 'localhost' ||
normalized === 'localhost.localdomain' ||
normalized.endsWith('.localhost.localdomain') ||
normalized.endsWith('.localhost') ||
normalized.endsWith('.local') ||
normalized.endsWith('.home.arpa') ||
normalized.endsWith('.internal') ||
normalized.endsWith('.lan') ||
normalized === 'metadata.google.internal'
normalized === 'metadata.google.internal' ||
normalized === 'localtest.me' ||
normalized.endsWith('.localtest.me') ||
normalized === 'lvh.me' ||
normalized.endsWith('.lvh.me') ||
normalized === 'vcap.me' ||
normalized.endsWith('.vcap.me') ||
normalized === 'nip.io' ||
normalized.endsWith('.nip.io') ||
normalized === 'sslip.io' ||
normalized.endsWith('.sslip.io') ||
normalized === 'xip.io' ||
normalized.endsWith('.xip.io')
) {
throw new Error(`${label} host is not allowed`);
}