hendrik/lens
1
0
Fork 0
mirror of https://github.com/lensapp/lens.git synced 2025-05-20 05:10:56 +00:00
Code Issues Projects Releases Wiki Activity

Block shell websocket connections from non-lens renderers

Browse Source 
Signed-off-by: Sebastian Malton <sebastian@malton.name>
This commit is contained in:
Sebastian Malton 2021-11-08 09:55:18 -05:00
parent 90d4899ece
commit 4e264d3c40
4 changed files with 25 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/lens-proxy.ts
View File

@ -82,7 +82,7 @@ export class LensProxy extends Singleton {
const reqHandler = isInternal ? shellApiRequest : kubeApiRequest;
(async () => reqHandler({ req, socket, head }))()
.catch(error => logger.error(logger.error(`[LENS-PROXY]: failed to handle proxy upgrade: ${error}`)));
.catch(error => logger.error("[LENS-PROXY]: failed to handle proxy upgrade", error));
});
}

35
src/main/proxy-functions/shell-api-request.ts
View File

@ -19,29 +19,38 @@
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/
import type http from "http";
import url from "url";
import logger from "../logger";
import * as WebSocket from "ws";
import { Server as WebSocketServer } from "ws";
import { NodeShellSession, LocalShellSession } from "../shell-session";
import type { ProxyApiRequestArgs } from "./types";
import { ClusterManager } from "../cluster-manager";
import { appName, appSemVer } from "../../common/vars";
import { LensProxy } from "../lens-proxy";
export function shellApiRequest({ req, socket, head }: ProxyApiRequestArgs) {
const ws = new WebSocket.Server({ noServer: true });
export function shellApiRequest({ req, socket, head }: ProxyApiRequestArgs): void {
const cluster = ClusterManager.getInstance().getClusterForRequest(req);
ws.on("connection", ((socket: WebSocket, req: http.IncomingMessage) => {
const cluster = ClusterManager.getInstance().getClusterForRequest(req);
if (
socket.remoteAddress !== "127.0.0.1"
|| !req.headers["user-agent"]?.includes(` ${appName}/${appSemVer} `)
|| !req.headers.origin?.endsWith(`.localhost:${LensProxy.getInstance().port}`)
|| !cluster
) {
socket.write("Invalid shell request");
return void socket.end();
}
const ws = new WebSocketServer({ noServer: true });
ws.handleUpgrade(req, socket, head, (webSocket) => {
const nodeParam = url.parse(req.url, true).query["node"]?.toString();
const shell = nodeParam
? new NodeShellSession(socket, cluster, nodeParam)
: new LocalShellSession(socket, cluster);
? new NodeShellSession(webSocket, cluster, nodeParam)
: new LocalShellSession(webSocket, cluster);
shell.open()
.catch(error => logger.error(`[SHELL-SESSION]: failed to open: ${error}`, { error }));
}));
ws.handleUpgrade(req, socket, head, (con) => {
ws.emit("connection", con, req);
.catch(error => logger.error(`[SHELL-SESSION]: failed to open a ${nodeParam ? "node" : "local"} shell`, error));
});
}

2
src/main/shell-session/node-shell-session.ts
View File

@ -19,7 +19,7 @@
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/
import type * as WebSocket from "ws";
import type WebSocket from "ws";
import { v4 as uuid } from "uuid";
import * as k8s from "@kubernetes/client-node";
import type { KubeConfig } from "@kubernetes/client-node";

2
src/main/shell-session/shell-session.ts
View File

@ -22,7 +22,7 @@
import fse from "fs-extra";
import type { Cluster } from "../cluster";
import { Kubectl } from "../kubectl";
import type * as WebSocket from "ws";
import type WebSocket from "ws";
import { shellEnv } from "../utils/shell-env";
import { app } from "electron";
import { clearKubeconfigEnvVars } from "../utils/clear-kube-env-vars";