Grasscutters/mitmproxy
3
0
Fork 0
mirror of https://github.com/Grasscutters/mitmproxy.git synced 2024-11-26 18:18:25 +00:00
Code Issues Projects Releases Wiki Activity

mitmweb: protect against dns rebinding

Browse Source
This commit is contained in:
Maximilian Hils 2018-07-11 18:56:49 +08:00
parent 9829fe150e
commit ae91779229
1 changed files with 30 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
mitmproxy/tools/web/app.py
View File

@ -466,7 +466,19 @@ class SaveOptions(RequestHandler):
class Application(tornado.web.Application): class Application(tornado.web.Application):
def __init__(self, master, debug): def __init__(self, master, debug):
self.master = master self.master = master
handlers = [ super().__init__(
template_path=os.path.join(os.path.dirname(__file__), "templates"),
static_path=os.path.join(os.path.dirname(__file__), "static"),
xsrf_cookies=True,
cookie_secret=os.urandom(256),
debug=debug,
autoreload=False,
)
self.add_handlers(
# make mitmweb accessible by IP only to prevent DNS rebinding.
r'(localhost|\d+\.\d+\.\d+\.\d+)',
[
(r"/", IndexHandler), (r"/", IndexHandler),
(r"/filter-help(?:\.json)?", FilterHelp), (r"/filter-help(?:\.json)?", FilterHelp),
(r"/updates", ClientConnection), (r"/updates", ClientConnection),
@ -490,12 +502,4 @@ class Application(tornado.web.Application):
(r"/options(?:\.json)?", Options), (r"/options(?:\.json)?", Options),
(r"/options/save", SaveOptions) (r"/options/save", SaveOptions)
] ]
settings = dict(
template_path=os.path.join(os.path.dirname(__file__), "templates"),
static_path=os.path.join(os.path.dirname(__file__), "static"),
xsrf_cookies=True,
cookie_secret=os.urandom(256),
debug=debug,
autoreload=False,
) )
super().__init__(handlers, **settings)