From 67a2a97056dfaf81632bccf8d341f9207f3cc509 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Tue, 2 Jun 2026 17:12:38 +0100
Subject: Warn about some potentially problematic <wsorigin> values.

---
 src/modules/m_websocket.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/modules/m_websocket.cpp b/src/modules/m_websocket.cpp
index 7a8630903..ebd66950b 100644
--- a/src/modules/m_websocket.cpp
+++ b/src/modules/m_websocket.cpp
@@ -719,6 +719,12 @@ public:
 			if (allow.empty())
 				throw ModuleException(this, "<wsorigin:allow> is a mandatory field, at " + tag->source.str());
 
+			if (insp::equalsci(allow, "*") || insp::equalsci(allow, "http://*") || insp::equalsci(allow, "https://*"))
+			{
+				ServerInstance->Logs.Warning(MODNAME, "<wsorigin> tag for {} at {} allows any website to connect to your server, this puts you at risk of web-based spam attacks!",
+					allow, tag->source.str());
+			}
+
 			config.allowedorigins.push_back(allow);
 		}
 
-- 
cgit v1.3.1-10-gc9f91