Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/webtorrent/webtorrent.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/lib/server.js
AgeCommit message (Collapse)Author
2021-10-26fix: Prep for esm (#2205)Jimmy Wärting
* prep for esm * update min req node vers * revert node prefix
2021-03-20Made two array into a setJimmy Wärting
2020-12-11replace process.nextTick with queueMicrotaskftreesmilo
2020-11-24styleFeross Aboukhadijeh
2019-09-11Return server from server.listen for method chaining to work (#1641)Feross Aboukhadijeh
Return server from server.listen for method chaining to work
2019-09-07server: Use relative URLsFeross Aboukhadijeh
Fixes: https://github.com/webtorrent/webtorrent/pull/1598
2019-08-27Address @diracdeltas feedback on #1714Feross Aboukhadijeh
2019-08-27Set security headers on /favicon.ico responsesFeross Aboukhadijeh
2019-08-27Fix http server XSSFeross Aboukhadijeh
Low risk xss. If the torrent contains a specially crafted title or file name, and the user starts the WebTorrent HTTP server via createServer(), and then the user visits the HTTP server index page (which lists the contents of the torrent), then the attacker can run JavaScript in this browser context. The reason this seems relatively low risk is that the WebTorrent HTTP server only allows fetching data pieces from the torrent. It doesn't support any other control of the torrent client. So, attacker code could e.g. figure out what content the user is downloading and exfiltrate that to an external domain. This commit mitigates the issue in two ways (either of which could have prevented this XSS on its own): 1. HTML-escape untrusted torrent metadata (name, path, file names, etc.) 2. Add the strictest possible CSP to prevent all connections, scripts, styles, plugins, frames. Every capability is denied.
2019-08-04remove require('url')Feross Aboukhadijeh
For: https://github.com/webtorrent/webtorrent/issues/1681
2019-08-01server: use 'application/octet-stream' mimetype as fallbackFeross Aboukhadijeh
Instead of a mimetype of "null" Fixes: https://github.com/brave/brave-browser/issues/5489
2019-07-30Fix server hostname deny featureFeross Aboukhadijeh
It appears that this feature, originally added in https://github.com/webtorrent/webtorrent/pull/1260, never worked correctly. When the request hostname does not match the user-provided opts.hostname value, we should stop processing the request and return nothing. Instead, what was happening was that we'd simply omit the Access-Control-Allow-Origin header, which is not sufficient since the whole point of DNS rebinding attacks is that they appear same origin and therefore don't require a CORS header.
2019-07-24Fix error in Chrome extension environmentFeross Aboukhadijeh
Fixes https://github.com/brave/brave-browser/issues/5358
2019-07-05'url.parse' was deprecated since v11.0.0. Use 'url.URL' constructor insteadFeross Aboukhadijeh
2019-06-19Remove semicolonDiego Rodríguez Baquero
2019-06-19Return server on listenDiego Rodríguez Baquero
2019-06-17Return server from server.listen for method chaining to workAnton Harniakou
2019-06-12ability to close and restore streamin serverArnaldas Augutis
2019-06-12ability to close and restore streamin serverArnaldas Augutis
2018-08-24Modernize lib/server.jsDiego Rodríguez
2018-05-10Access-Control-Allow-Methods are GET,HEADFeross Aboukhadijeh
Fixes: https://github.com/webtorrent/webtorrent/issues/1267
2018-03-03Merge pull request #1260 from diracdeltas/fix/add-hostname-optFeross Aboukhadijeh
Add hostname option to mitigate DNS rebinding
2018-03-03simplify double if statementFeross Aboukhadijeh
2018-01-26mime@2Feross Aboukhadijeh
2018-01-12Add hostname option to mitigate DNS rebindingyan
This adds the `hostname` opt to allow the server to validate the `Host` header of incoming requests to prevent DNS rebinding attacks. Needed for https://github.com/brave/browser-laptop/issues/12616.
2017-04-08Add `origin` option for torrent.createServer()Feross Aboukhadijeh
When the origin option is specified, only requests from the given origin will be allowed. This is useful to add additional security to any app that is starting a WebTorrent server but doesn't want it to be exposed to the entire Web.
2017-03-17Merge pull request #1078 from pahwaranger/masterFeross Aboukhadijeh
add filename to path
2017-03-17add filename to URLpahwaranger
2017-03-17doc: torrent.createServer() takes a function argumentFeross Aboukhadijeh
2017-02-10Refactor http server; support content-dispositionFeross Aboukhadijeh
Refactored the server into many smaller functions to make it easier to understand all the different code paths. - added a Content-Disposition header, which tells the browser the file's name, since we use urls like http://localhost:port/0 <-- no human-readable file name - Server returns valid HTML documents (with all the required tags) now. - Return 204 status for OPTIONS request - reduce access-control-max-age to chromium max of 600s - respond to OPTIONS requests that lack 'access-control-request-headers' (before they were treated as GET) - return '405 invalid verb' for all other verbs For: https://github.com/brave/browser-laptop/issues/6737
2016-09-18server: Handle invalid range handers instead of throwing (#921)Feross Aboukhadijeh
Fixes: #920
2016-09-05Handle no-arg server.destroy(), fixes #899DC
2016-09-05Fix server.close, fixes #900DC
2016-06-22WebTorrent http server: Fix HEAD requestsFeross Aboukhadijeh
Don't send the entire response body
2016-04-21cleanup torrent reference leaksFeross Aboukhadijeh
2016-03-29Replace expensive arr.splice() with unordered-array-remove in hot codeFeross Aboukhadijeh
For https://github.com/feross/webtorrent-desktop/issues/256
2016-03-29remove prettier-bytes dependencyFeross Aboukhadijeh
2016-03-11replace pretty-bytes with prettier-bytesFeross Aboukhadijeh
2015-12-27torrent server only call internal `server.close` onceFeross Aboukhadijeh
If the user calls `server.close()` on the http server returned by `torrnet.createServer()` then we should not call it in `server.destroy()` or node will return an error
2015-12-17Improve torrent.createServer() index pageFeross Aboukhadijeh
- Download link uses correct filename - List shows file paths, not just name - Add file size - Show torrent name at top, instead of generic “WebTorrent” title
2015-07-28cmd: --vlc keeps the event loop alive during "graceful exit" stage (fix #388)Feross Aboukhadijeh
2015-07-03http server: send 404 messageFeross Aboukhadijeh
2015-03-07style: always use bracesFeross Aboukhadijeh
2015-03-04styleFeross Aboukhadijeh
2015-03-04dlna header fixFeross Aboukhadijeh
2015-01-27pass createServer(opts) to http serverFeross Aboukhadijeh
2015-01-27JavaScript Standard StyleFeross Aboukhadijeh
2014-12-31Support DLNA streamingFeross Aboukhadijeh
2014-11-22server: statusCode 200 unless range requestAstro
2014-10-22server: homepage list files in torrentFeross Aboukhadijeh
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-06 02:50:21 +0300