From 9372979fb54d6d2c52334abfab6ce72faf6c29e1 Mon Sep 17 00:00:00 2001 From: Dan Stillman Date: Mon, 26 Jun 2017 07:52:23 -0400 Subject: [PATCH] Allow Zotero.Server requests with `Host: localhost` Previously only Host: 127.0.0.1 was allowed. (The check prevents a DNS rebinding attack.) This allows requests to translation-server using localhost (zotero/translation-server#48). Fixes #125 --- chrome/content/zotero/xpcom/server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chrome/content/zotero/xpcom/server.js b/chrome/content/zotero/xpcom/server.js index 74067e883d..bf0c3b79c8 100755 --- a/chrome/content/zotero/xpcom/server.js +++ b/chrome/content/zotero/xpcom/server.js @@ -237,7 +237,7 @@ Zotero.Server.DataListener.prototype._headerFinished = function() { Zotero.debug(this.header, 5); const methodRe = /^([A-Z]+) ([^ \r\n?]+)(\?[^ \r\n]+)?/; - const hostRe = /[\r\n]Host: *127\.0\.0\.1(:[0-9]+)?[\r\n]/i; + const hostRe = /[\r\n]Host: *(localhost|127\.0\.0\.1)(:[0-9]+)?[\r\n]/i; const contentTypeRe = /[\r\n]Content-Type: *([^ \r\n]+)/i; if(!Zotero.isServer) {