zacheryasc/swactor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(dashboard): bind the server to loopback

Browse source 
Restrict the local dashboard listener to 127.0.0.1 instead of exposing it on every interface, with a listener-address regression test.
This commit is contained in:
Zachery Aaron Shores-Chmielewski 2026-08-28 02:09:38 +04:00
parent 8c39ac0440
commit 3fc43cc311
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
crates/dashboard/src/server.rs
View file

@ -25,12 +25,16 @@ pub(crate) struct AppState {
pub shutdown_notify: Arc<tokio::sync::Notify>,
}
async fn bind_listener(port: u16) -> std::io::Result<tokio::net::TcpListener> {
tokio::net::TcpListener::bind(("127.0.0.1", port)).await
}
pub(crate) async fn run_server(state: AppState, port: u16) {
run_server_with_routes(state, port, Router::new()).await;
}
pub(crate) async fn run_server_with_routes(state: AppState, port: u16, extra: Router) {
let listener = tokio::net::TcpListener::bind(format!("0.0.0.0:{port}"))
let listener = bind_listener(port)
.await
.expect("failed to bind HTTP server");
let shutdown = Arc::clone(&state.shutdown_notify);
@ -342,6 +346,13 @@ mod tests {
}
}
#[tokio::test]
async fn dashboard_listener_is_loopback_only() {
let listener = bind_listener(0).await.expect("bind dashboard listener");
let address = listener.local_addr().expect("read dashboard address");
assert!(address.ip().is_loopback(), "dashboard bound to {address}");
}
#[test]
fn registered_plugin_page_appears_in_shared_navigation() {
let state = state_with_plugin(PluginPage::new(