diff --git a/lib/Server.js b/lib/Server.js index 79e6fc7910..31ab1e9b59 100644 --- a/lib/Server.js +++ b/lib/Server.js @@ -1,5 +1,10 @@ "use strict"; +function isTrustedClient(req) { + // Only allow injection if client explicitly identifies itself + return req.headers["webpack-dev-server-client"] === "true"; +} + const os = require("os"); const path = require("path"); const url = require("url"); @@ -2103,6 +2108,13 @@ class Server { /** @type {import("webpack-dev-middleware").API}*/ (middleware).waitUntilValid((stats) => { res.setHeader("Content-Type", "text/html"); + + if (!isTrustedClient(req)) { + res.statusCode = 403; + res.end("Access denied: Missing required dev server client header."); + return; + } + res.write( '' ); diff --git a/package.json b/package.json index d0ed834b74..b161d4d7ea 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { - "name": "webpack-dev-server", - "version": "4.15.2", + "name": "webpack-dev-server-wajih", + "version": "4.6.0-patched", "description": "Serves a webpack app. Updates the browser on changes.", "bin": "bin/webpack-dev-server.js", "main": "lib/Server.js",