44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
# UNDF: UNDF-2026-000000730
|
|
--- a/pkg/api/serve_other.go
|
|
+++ b/pkg/api/serve_other.go
|
|
@@ -48,7 +48,7 @@ type apiHandler struct {
|
|
keyfileToLower string
|
|
certfileToLower string
|
|
fallback string
|
|
- hosts []string
|
|
+ hosts map[string]struct{} // O(1) lookup per HTTP request; was O(H) []string scan
|
|
corsOrigin []string
|
|
serveWaitGroup sync.WaitGroup
|
|
|
|
@@ -139,14 +139,10 @@ func (h *apiHandler) ServeHTTP(res http.ResponseWriter, req *http.Request) {
|
|
// Check the "Host" header to prevent DNS rebinding attacks
|
|
if strings.ContainsRune(req.Host, ':') {
|
|
if host, _, err := net.SplitHostPort(req.Host); err == nil {
|
|
req.Host = host
|
|
}
|
|
}
|
|
- if req.Host != "localhost" {
|
|
- ok := false
|
|
- for _, allowed := range h.hosts {
|
|
- if req.Host == allowed {
|
|
- ok = true
|
|
- break
|
|
- }
|
|
- }
|
|
- if !ok {
|
|
+ if req.Host != "localhost" {
|
|
+ if _, ok := h.hosts[req.Host]; !ok {
|
|
go h.notifyRequest(time.Since(start), req, http.StatusForbidden)
|
|
res.WriteHeader(http.StatusForbidden)
|
|
maybeWriteResponseBody([]byte(fmt.Sprintf("403 - Forbidden: The host %q is not allowed", req.Host)))
|
|
|
|
@@ -894,7 +890,11 @@ func serve(ctx *bundleContext, serveOptions ServeOptions, result []BuildResult) (
|
|
handler := &apiHandler{
|
|
...
|
|
- hosts: append([]string{}, result.Hosts...),
|
|
+ hosts: func() map[string]struct{} {
|
|
+ m := make(map[string]struct{}, len(result.Hosts))
|
|
+ for _, h := range result.Hosts { m[h] = struct{}{} }
|
|
+ return m
|
|
+ }(),
|
|
corsOrigin: append([]string{}, serveOptions.CORS.Origin...),
|