fix: the /proxy/:port and /absproxy/:port endpoints ... in index.ts

The /proxy/:port and /absproxy/:port endpoints allow authenticated users to proxy requests to arbitrary ports on localhost

Author: anupamme

src/node/routes/index.ts

@@ -90,7 +90,8 @@ export const register = async (
     // TODO: This does *NOT* work if you have a base path since to specify the
     // protocol we need to specify the whole path.
     if (args.cert && !(req.connection as tls.TLSSocket).encrypted) {
-      return res.redirect(`https://${req.headers.host}${req.originalUrl}`)
+      const host = String(req.headers.host || "").replace(/[^\w.\-:[\]]/g, "")
+      return res.redirect(`https://${host}${req.originalUrl}`)
     }
     next()
   })

src/node/routes/pathProxy.ts

@@ -15,7 +15,7 @@ const getProxyTarget = (
   const base = (req as any).base || ""
   // Cast since we only have one port param.
   const port = parseInt(req.params.port as string, 10)
-  if (isNaN(port)) {
+  if (isNaN(port) || port < 1024 || port > 65535) {
     throw new HttpError("Invalid port", HttpCode.BadRequest)
   }
   return `http://0.0.0.0:${port}${opts?.proxyBasePath || ""}/${req.originalUrl.slice(base.length)}`