Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-10 23:36:14 -05:00
Code Issues Activity

🐛 Fixed 500 errors for incorrect Origin headers (#11433)

Browse source 
no-issue

Our function for determining cors options created a new instance of URL
without wrapping it in a try/catch which meant any failures to parse the
URL bubbled down as a 500 error.

500 errors are commonly used for alerting at the infrastructure level,
and this error is definitely one caused by a badly configured client, so
we wrap the construction and crap out with a Bad Request Error (HTTP
400) if it fails.
This commit is contained in:
Fabien O'Carroll 2019-12-04 13:06:30 +02:00 • committed by Naz Gargol
parent 3d49f3ed15
commit 2cd8f89933
1 changed files with 30 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
core/server/web/site/app.js
View file

@ -3,6 +3,7 @@ const path = require('path');
const express = require('express');
const cors = require('cors');
const {URL} = require('url');
const common = require('../../lib/common');
// App requires
const config = require('../../config');
@ -30,27 +31,38 @@ const corsOptionsDelegate = function corsOptionsDelegate(req, callback) {
credentials: true // required to allow admin-client to login to private sites
};
if (origin) {
const originUrl = new URL(origin);
if (!origin) {
return callback(null, corsOptions);
}
// allow all localhost and 127.0.0.1 requests no matter the port
if (originUrl.hostname === 'localhost' || originUrl.hostname === '127.0.0.1') {
let originUrl;
try {
originUrl = new URL(origin);
} catch (err) {
return callback(new common.errors.BadRequestError({err}));
}
// originUrl will definitely exist here because according to WHATWG URL spec
// The class constructor will either throw a TypeError or return a URL object
// https://url.spec.whatwg.org/#url-class
// allow all localhost and 127.0.0.1 requests no matter the port
if (originUrl.hostname === 'localhost' || originUrl.hostname === '127.0.0.1') {
corsOptions.origin = true;
}
// allow the configured host through on any protocol
const siteUrl = new URL(config.get('url'));
if (originUrl.host === siteUrl.host) {
corsOptions.origin = true;
}
// allow the configured admin:url host through on any protocol
if (config.get('admin:url')) {
const adminUrl = new URL(config.get('admin:url'));
if (originUrl.host === adminUrl.host) {
corsOptions.origin = true;
}
// allow the configured host through on any protocol
const siteUrl = new URL(config.get('url'));
if (originUrl.host === siteUrl.host) {
corsOptions.origin = true;
}
// allow the configured admin:url host through on any protocol
if (config.get('admin:url')) {
const adminUrl = new URL(config.get('admin:url'));
if (originUrl.host === adminUrl.host) {
corsOptions.origin = true;
}
}
}
callback(null, corsOptions);