mirror of
https://github.com/vee1e/subidx.git
synced 2026-09-01 17:57:13 +00:00
lakshit verma
9a232a950c
The API accepted any Host header, so a page running a DNS rebinding attack could point attacker.com at 127.0.0.1 and read the collected index from the victim's browser as same-origin JavaScript. Requests whose Host is not localhost/127.0.0.1/::1 now get 421; -allowed-hosts extends the list for exposed deployments. Rate limiting keyed on the victim's own IP provided no protection here.
5 lines
36 B
Text
5 lines
36 B
Text
/subidx
|
|
/data/
|
|
*.log
|
|
SPEC.md
|
|
/docs/
|