diff options
| author |  Sadie Powell | 2026-06-02 17:12:38 +0100 |
|---|---|---|
| committer | Sadie Powell | 2026-06-03 08:23:03 +0100 |
| commit | 67a2a97056dfaf81632bccf8d341f9207f3cc509 (patch) | |
| tree | aa91dd8971da20a63431a6519064fddc8cb298af /src/modules/m_websocket.cpp | |
| parent | Fix FJOINs wrapped by the compat layer not being prefixed properly. (diff) | |
Warn about some potentially problematic <wsorigin> values.
Diffstat (limited to 'src/modules/m_websocket.cpp')
| -rw-r--r-- | src/modules/m_websocket.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp index 7a8630903..ebd66950b 100644 --- a/src/modules/m_websocket.cpp +++ b/src/modules/m_websocket.cpp @@ -719,6 +719,12 @@ public: if (allow.empty()) throw ModuleException(this, "<wsorigin:allow> is a mandatory field, at " + tag->source.str()); + if (insp::equalsci(allow, "*") || insp::equalsci(allow, "http://*") || insp::equalsci(allow, "https://*")) + { + ServerInstance->Logs.Warning(MODNAME, "<wsorigin> tag for {} at {} allows any website to connect to your server, this puts you at risk of web-based spam attacks!", + allow, tag->source.str()); + } + config.allowedorigins.push_back(allow); } |