Ban cross origin WebSocket connections to the service protocol

runtime/bin/vmservice/server.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of vmservice_io;
 
 class WebSocketClient extends Client {
   static const int PARSE_ERROR_CODE = 4000;
   static const int BINARY_MESSAGE_ERROR_CODE = 4001;
   static const int NOT_MAP_ERROR_CODE = 4002;
@@ skipping 87 matching lines @@
   }
 }
 
 class Server {
   static const WEBSOCKET_PATH = '/ws';
   static const ROOT_REDIRECT_PATH = '/index.html';
 
   final VMService _service;
   final String _ip;
   final int _port;
-
+  final bool _originCheckDisabled;
+  final List<String> _allowedOrigins = <String>[];
   HttpServer _server;
   bool get running => _server != null;
   bool _displayMessages = false;
 
-  Server(this._service, this._ip, this._port) {
+  Server(this._service, this._ip, this._port, this._originCheckDisabled) {
     _displayMessages = (_ip != '127.0.0.1' || _port != 8181);
   }
 
+  void _addOrigin(String host, String port) {
+    String origin = 'http://$host:$port';
+    _allowedOrigins.add(origin);
+  }
+
+  bool _isAllowedOrigin(String origin) {
+    for (String allowedOrigin in _allowedOrigins) {
+      if (origin.startsWith(allowedOrigin)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  bool _originCheck(HttpRequest request) {
+    if (_originCheckDisabled) {
+      // Always allow.
+      return true;
+    }
+    // First check the web-socket specific origin.
+    List<String> origins = request.headers["Sec-WebSocket-Origin"];
+    if (origins == null) {
+      // Fall back to the general Origin field.
+      origins = request.headers["Origin"];
+    }
+    if (origins == null) {
+      // No origin sent. This is a non-browser client or a same-origin request.
+      return true;
+    }
+    for (String origin in origins) {
+      if (_isAllowedOrigin(origin)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   void _requestHandler(HttpRequest request) {
-    // Allow cross origin requests with 'observatory' header.
-    request.response.headers.add('Access-Control-Allow-Origin', '*');
-    request.response.headers.add('Access-Control-Allow-Headers',
-                                 'Observatory-Version');
-
+    if (!_originCheck(request)) {
+      // This is a cross origin attempt to connect
+      request.response.close();
+      return;
+    }
     if (request.method != 'GET') {
       // Not a GET request. Do nothing.
       request.response.close();
       return;
     }
 
     final String path =
           request.uri.path == '/' ? ROOT_REDIRECT_PATH : request.uri.path;
 
     if (path == WEBSOCKET_PATH) {
@@ skipping 25 matching lines @@
       rethrow;
     }
   }
 
   Future startup() {
     if (_server != null) {
       // Already running.
       return new Future.value(this);
     }
 
+    // Clear allowed origins.
+    _allowedOrigins.clear();
+
     var address = new InternetAddress(_ip);
     // Startup HTTP server.
     return HttpServer.bind(address, _port).then((s) {
       _server = s;
       _server.listen(_requestHandler, cancelOnError: true);
       var ip = _server.address.address.toString();
       var port = _server.port.toString();
+      // Add the numeric ip and host name to our allowed origins.
+      _addOrigin(ip, port);
+      _addOrigin(_server.address.host.toString(), port);
+      // Explicitly add localhost and 127.0.0.1.
+      _addOrigin('localhost', port);
+      _addOrigin('127.0.0.1', port);
       if (_displayMessages) {
         print('Observatory listening on http://$ip:$port');
       }
       // Server is up and running.
       _notifyServerState(ip, _server.port);
       onServerAddressChange('http://$ip:$port');
       return this;
     }).catchError((e, st) {
       print('Could not start Observatory HTTP server:\n$e\n$st\n');
       _notifyServerState("", 0);
@@ skipping 35 matching lines @@
       _notifyServerState("", 0);
       onServerAddressChange(null);
       return this;
     });
   }
 
 }
 
 void _notifyServerState(String ip, int port)
     native "VMServiceIO_NotifyServerState";