microlinkhq / browserless / 39833947006

78%

push

github

fix: add the browser socket to a hosts list (#1003)

* fix: add the browser socket to a hosts list

isolated-function no longer exempts loopback from hosts. The socket is
an explicit entry, and ssrf still allows only that port.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix: parse the browser socket once for the hosts list

Splitting the grant string could leave brackets on an IPv6 address, and
taking hosts out of the options dropped any value that was not a list.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

2138 of 2423 branches covered (88.24%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

7740 of 10334 relevant lines covered (74.9%)

58161.1 hits per line