Ban cross origin WebSocket connections to the service protocol

runtime/bin/main.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
 
 #include "include/dart_api.h"
 #include "include/dart_tools_api.h"
@@ skipping 101 matching lines @@
 static bool trace_loading = false;
 
 
 static const char* DEFAULT_VM_SERVICE_SERVER_IP = "127.0.0.1";
 static const int DEFAULT_VM_SERVICE_SERVER_PORT = 8181;
 // VM Service options.
 static const char* vm_service_server_ip = DEFAULT_VM_SERVICE_SERVER_IP;
 // The 0 port is a magic value which results in the first available port
 // being allocated.
 static int vm_service_server_port = -1;
-
+// True when we are running in development mode and cross origin security
+// checks are disabled.
+static bool vm_service_dev_mode = false;
 
 // Exit code indicating an API error.
 static const int kApiErrorExitCode = 253;
 // Exit code indicating a compilation error.
 static const int kCompilationErrorExitCode = 254;
 // Exit code indicating an unhandled error that is not a compilation error.
 static const int kErrorExitCode = 255;
 // Exit code indicating a vm restart request.  Never returned to the user.
 static const int kRestartRequestExitCode = 1000;
 
@@ skipping 253 matching lines @@
                         DEFAULT_VM_SERVICE_SERVER_IP)) {
     Log::PrintErr("unrecognized --enable-vm-service option syntax. "
                   "Use --enable-vm-service[=<port number>[/<IPv4 address>]]\n");
     return false;
   }
 
   return true;
 }
 
 
+static bool ProcessServiceDevModeOption(const char* option_value,
+                                        CommandLineOptions* vm_options) {
+  ASSERT(option_value != NULL);
+  Log::PrintErr("WARNING: You are running with the service protocol in an "
+                "insecure mode.\n");
+  vm_service_dev_mode = true;
+  return true;
+}
+
+
 static bool ProcessObserveOption(const char* option_value,
                                  CommandLineOptions* vm_options) {
   ASSERT(option_value != NULL);
 
   if (!ExtractPortAndIP(option_value,
                         &vm_service_server_port,
                         &vm_service_server_ip,
                         DEFAULT_VM_SERVICE_SERVER_PORT,
                         DEFAULT_VM_SERVICE_SERVER_IP)) {
     Log::PrintErr("unrecognized --observe option syntax. "
@@ skipping 77 matching lines @@
   { "--help", ProcessHelpOption },
   { "--packages=", ProcessPackagesOption },
   { "--package-root=", ProcessPackageRootOption },
   { "-v", ProcessVerboseOption },
   { "--verbose", ProcessVerboseOption },
   { "--version", ProcessVersionOption },
 
   // VM specific options to the standalone dart program.
   { "--compile_all", ProcessCompileAllOption },
   { "--enable-vm-service", ProcessEnableVmServiceOption },
+  { "--service-dev-mode", ProcessServiceDevModeOption },

[skybrian, 2016/07/07 18:08:08]

The meaning of this flag seems a bit subtle. Could we rename it to something
like "--disable-observatory-origin-check" so it's more obvious?

[Cutch, 2016/07/07 18:31:56]

Done but Observatory != service protocol, so the flag is now
--disable-service-origin-check. 

   { "--observe", ProcessObserveOption },
   { "--shutdown", ProcessShutdownOption },
   { "--snapshot=", ProcessSnapshotFilenameOption },
   { "--snapshot-kind=", ProcessSnapshotKindOption },
   { "--run-app-snapshot=", ProcessRunAppSnapshotOption },
   { "--use-blobs", ProcessUseBlobsOption },
   { "--trace-loading", ProcessTraceLoadingOption },
   { "--hot-reload-test-mode", ProcessHotReloadTestModeOption },
   { NULL, NULL }
 };
@@ skipping 256 matching lines @@
 
   // Set up the library tag handler for this isolate.
   Dart_Handle result = Dart_SetLibraryTagHandler(Loader::LibraryTagHandler);
   CHECK_RESULT(result);
 
   if (Dart_IsServiceIsolate(isolate)) {
     // If this is the service isolate, load embedder specific bits and return.
     bool skip_library_load = run_app_snapshot;
     if (!VmService::Setup(vm_service_server_ip,
                           vm_service_server_port,
-                          skip_library_load)) {
+                          skip_library_load,
+                          vm_service_dev_mode)) {
       *error = strdup(VmService::GetErrorMessage());
       return NULL;
     }
     if (compile_all) {
       result = Dart_CompileAll();
       CHECK_RESULT(result);
     }
     Dart_ExitScope();
     Dart_ExitIsolate();
     return isolate;
@@ skipping 989 matching lines @@
   Platform::Exit(Process::GlobalExitCode());
 }
 
 }  // namespace bin
 }  // namespace dart
 
 int main(int argc, char** argv) {
   dart::bin::main(argc, argv);
   UNREACHABLE();
 }