GeezerVison is showing github.com — lib: add warning when binding inspector to public IP · nodejs/node@2a580b9
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: lib/inspector.js +13Lines changed: 13 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -18,6 +18,8 @@ const { | 18 | 18 | ERR_INSPECTOR_NOT_WORKER, | 19 | 19 | } = require('internal/errors').codes; | 20 | 20 |
| | 21 | +const { isLoopback } = require('internal/net'); | | 22 | + | 21 | 23 | const { hasInspector } = internalBinding('config'); | 22 | 24 | if (!hasInspector) | 23 | 25 | throw new ERR_INSPECTOR_NOT_AVAILABLE(); | @@ -172,6 +174,17 @@ function inspectorOpen(port, host, wait) { | 172 | 174 | if (isUint32(port)) { | 173 | 175 | validateInt32(port, 'port', 0, 65535); | 174 | 176 | } | | 177 | + if (host && !isLoopback(host)) { | | 178 | + process.emitWarning( | | 179 | + 'Binding the inspector to a public IP with an open port is insecure, ' + | | 180 | + 'as it allows external hosts to connect to the inspector ' + | | 181 | + 'and perform a remote code execution attack. ' + | | 182 | + 'Documentation can be found at ' + | | 183 | + 'https://nodejs.org/api/cli.html#--inspecthostport', | | 184 | + 'SecurityWarning', | | 185 | + ); | | 186 | + } | | 187 | + | 175 | 188 | open(port, host); | 176 | 189 | if (wait) | 177 | 190 | waitForDebugger(); | |
Collapse file Copy file name to clipboardExpand all lines: lib/internal/net.js +17Lines changed: 17 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -68,11 +68,28 @@ function makeSyncWrite(fd) { | 68 | 68 | }; | 69 | 69 | } | 70 | 70 |
| | 71 | +/** | | 72 | + * https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml | | 73 | + * https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml | | 74 | + * https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml | | 75 | + */ | | 76 | +function isLoopback(host) { | | 77 | + const hostLower = host.toLowerCase(); | | 78 | + | | 79 | + return ( | | 80 | + hostLower === 'localhost' || | | 81 | + hostLower.startsWith('127.') || | | 82 | + hostLower.startsWith('[::1]') || | | 83 | + hostLower.startsWith('[0:0:0:0:0:0:0:1]') | | 84 | + ); | | 85 | +} | | 86 | + | 71 | 87 | module.exports = { | 72 | 88 | kReinitializeHandle: Symbol('kReinitializeHandle'), | 73 | 89 | isIP, | 74 | 90 | isIPv4, | 75 | 91 | isIPv6, | 76 | 92 | makeSyncWrite, | 77 | 93 | normalizedArgsSymbol: Symbol('normalizedArgs'), | | 94 | + isLoopback, | 78 | 95 | }; |
Collapse file Copy file name to clipboard +16Lines changed: 16 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +'use strict'; | | 2 | + | | 3 | +const common = require('../common'); | | 4 | +common.skipIfInspectorDisabled(); | | 5 | + | | 6 | +const inspector = require('inspector'); | | 7 | +inspector.open(0, '0.0.0.0', false); | | 8 | +common.expectWarning( | | 9 | + 'SecurityWarning', | | 10 | + 'Binding the inspector to a public IP with an open port is insecure, ' + | | 11 | + 'as it allows external hosts to connect to the inspector ' + | | 12 | + 'and perform a remote code execution attack. ' + | | 13 | + 'Documentation can be found at ' + | | 14 | + 'https://nodejs.org/api/cli.html#--inspecthostport' | | 15 | +); | | 16 | +inspector.close(); |
Collapse file Copy file name to clipboard +32Lines changed: 32 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +// Flags: --expose-internals | | 2 | +'use strict'; | | 3 | +require('../common'); | | 4 | +const assert = require('assert'); | | 5 | +const net = require('internal/net'); | | 6 | + | | 7 | +const loopback = [ | | 8 | + 'localhost', | | 9 | + '127.0.0.1', | | 10 | + '127.0.0.255', | | 11 | + '127.1.2.3', | | 12 | + '[::1]', | | 13 | + '[0:0:0:0:0:0:0:1]', | | 14 | +]; | | 15 | + | | 16 | +const loopbackNot = [ | | 17 | + 'example.com', | | 18 | + '192.168.1.1', | | 19 | + '10.0.0.1', | | 20 | + '255.255.255.255', | | 21 | + '[2001:db8::1]', | | 22 | + '[fe80::1]', | | 23 | + '8.8.8.8', | | 24 | +]; | | 25 | + | | 26 | +for (const address of loopback) { | | 27 | + assert.strictEqual(net.isLoopback(address), true); | | 28 | +} | | 29 | + | | 30 | +for (const address of loopbackNot) { | | 31 | + assert.strictEqual(net.isLoopback(address), false); | | 32 | +} |
|