melabidi/carmanagement
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

apply security fix
Build & Push / Build & Push Docker Image (push) Failing after 3m46s
Details

Browse Source
This commit is contained in:
root
2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/dashboard/src/app/api/v1/[...path]/route.ts
+15 -2
View File
@@ -4,6 +4,17 @@ type RouteContext = {
params: Promise<{ path?: string[] }> | { path?: string[] }
}
const SPOOFABLE_FORWARDING_HEADERS = new Set([
'forwarded',
'x-forwarded-for',
'x-forwarded-host',
'x-forwarded-proto',
'x-real-ip',
'cf-connecting-ip',
'true-client-ip',
'x-client-ip',
])
const HOP_BY_HOP_HEADERS = new Set([
'connection',
'content-encoding',
@@ -51,7 +62,8 @@ function getSetCookieHeaders(headers: Headers): string[] {
function copyRequestHeaders(request: Request): Headers {
const headers = new Headers()
request.headers.forEach((value, key) => {
if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase())) headers.set(key, value)
const normalized = key.toLowerCase()
if (!HOP_BY_HOP_HEADERS.has(normalized) && !SPOOFABLE_FORWARDING_HEADERS.has(normalized)) headers.set(key, value)
})
return headers
}
@@ -59,7 +71,8 @@ function copyRequestHeaders(request: Request): Headers {
function copyResponseHeaders(upstream: Response): Headers {
const headers = new Headers()
upstream.headers.forEach((value, key) => {
if (!HOP_BY_HOP_HEADERS.has(key.toLowerCase())) headers.set(key, value)
const normalized = key.toLowerCase()
if (!HOP_BY_HOP_HEADERS.has(normalized) && !SPOOFABLE_FORWARDING_HEADERS.has(normalized)) headers.set(key, value)
})
return headers
}