47 lines
1.1 KiB
Go
47 lines
1.1 KiB
Go
|
// Package localaccess prevents unrelated browser pages from driving local RPCs.
|
||
|
|
package localaccess
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net"
|
||
|
|
"net/http"
|
||
|
|
"net/url"
|
||
|
|
"strings"
|
||
|
|
)
|
||
|
|
|
||
|
|
func AllowedOrigin(raw string) bool {
|
||
|
|
if raw == "" {
|
||
|
|
return true
|
||
|
|
} // Native Cursor/CLI requests do not send Origin.
|
||
|
|
u, err := url.Parse(raw)
|
||
|
|
if err != nil || u.User != nil || u.Hostname() == "" {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
switch strings.ToLower(u.Scheme) {
|
||
|
|
case "vscode-file", "vscode-webview", "wails":
|
||
|
|
return true
|
||
|
|
case "http", "https":
|
||
|
|
default:
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
host := strings.ToLower(u.Hostname())
|
||
|
|
if host == "localhost" || host == "wails.localhost" || net.ParseIP(host).IsLoopback() {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
for _, domain := range []string{"cursor.sh", "cursor.com"} {
|
||
|
|
if host == domain || strings.HasSuffix(host, "."+domain) {
|
||
|
|
return u.Scheme == "https"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
func Wrap(next http.Handler) http.Handler {
|
||
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||
|
|
if !AllowedOrigin(r.Header.Get("Origin")) {
|
||
|
|
http.Error(w, "untrusted browser origin", http.StatusForbidden)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
next.ServeHTTP(w, r)
|
||
|
|
})
|
||
|
|
}
|