webpack
diff --git a/Collapse file
‎.changeset/handle-malformed-host-origin-headers.md‎
Copy file name to clipboard
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff b/Collapse file
‎.changeset/handle-malformed-host-origin-headers.md‎
Copy file name to clipboard
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
diff --git a/Collapse file
‎lib/Server.js‎
Copy file name to clipboardExpand all lines: lib/Server.js
+13-7Lines changed: 13 additions & 7 deletions b/Collapse file
‎lib/Server.js‎
Copy file name to clipboardExpand all lines: lib/Server.js
+13-7Lines changed: 13 additions & 7 deletions
diff --git a/Collapse file
‎test/e2e/cross-origin-request.test.js‎
Copy file name to clipboardExpand all lines: test/e2e/cross-origin-request.test.js
+102Lines changed: 102 additions & 0 deletions b/Collapse file
‎test/e2e/cross-origin-request.test.js‎
Copy file name to clipboardExpand all lines: test/e2e/cross-origin-request.test.js
+102Lines changed: 102 additions & 0 deletions
@@ -0,0 +1,5 @@
+---
+"webpack-dev-server": patch
+---
+
+Handle malformed `Host` and `Origin` header values gracefully when validating requests.
@@ -3304,14 +3304,20 @@ class Server {
     }
 
     // use the node url-parser to retrieve the hostname from the host-header.
-    // TODO resolve me in the next major release
-    // eslint-disable-next-line n/no-deprecated-api
-    const { hostname } = url.parse(
+    let hostname;
+
+    try {
       // if header doesn't have scheme, add // for parsing.
-      /^(.+:)?\/\//.test(header) ? header : `//${header}`,
-      false,
-      true,
-    );
+      // TODO resolve me in the next major release
+      // eslint-disable-next-line n/no-deprecated-api
+      ({ hostname } = url.parse(
+        /^(.+:)?\/\//.test(header) ? header : `//${header}`,
+        false,
+        true,
+      ));
+    } catch {
+      return false;
+    }
 
     if (hostname === null) {
       return false;
 
@@ -463,3 +463,105 @@ describe("cross-site request forgery on state-changing endpoints", () => {
     expect(res.status).toBe(200);
   });
 });
+
+describe("malformed Host/Origin headers", () => {
+  const devServerPort = port1;
+
+  let server;
+
+  afterEach(async () => {
+    if (server) {
+      await server.stop();
+      // Allow the port to be fully released before the next test
+      await new Promise((resolve) => {
+        setTimeout(resolve, 100);
+      });
+      server = null;
+    }
+  });
+
+  it("should reject a WebSocket upgrade with a malformed Origin header without crashing", async () => {
+    const WebSocket = require("ws");
+    const http = require("node:http");
+
+    const compiler = webpack(config);
+    server = new Server(
+      { port: devServerPort, allowedHosts: "auto" },
+      compiler,
+    );
+
+    await server.start();
+
+    // A malformed `Origin` (invalid IPv6 literal) used to throw while being
+    // parsed and take down the whole dev-server process.
+    await new Promise((resolve) => {
+      const ws = new WebSocket(`ws://localhost:${devServerPort}/ws`, {
+        headers: {
+          host: `localhost:${devServerPort}`,
+          origin: "http://[::1/",
+        },
+      });
+
+      ws.on("close", resolve);
+      ws.on("error", resolve);
+    });
+
+    // The server must still be alive: a normal request still succeeds.
+    const status = await new Promise((resolve, reject) => {
+      http
+        .get(`http://localhost:${devServerPort}/main.js`, (res) => {
+          res.resume();
+          resolve(res.statusCode);
+        })
+        .on("error", reject);
+    });
+
+    expect(status).toBe(200);
+  });
+
+  it("should reject a request with a malformed Host header without crashing", async () => {
+    const net = require("node:net");
+    const http = require("node:http");
+
+    const compiler = webpack(config);
+    server = new Server(
+      { port: devServerPort, allowedHosts: "auto" },
+      compiler,
+    );
+
+    await server.start();
+
+    // A malformed `Host` (invalid IPv6 literal) sent on a plain request used to
+    // throw while being parsed and take down the whole dev-server process. Sent
+    // over a raw socket so the malformed value reaches the server as-is.
+    await new Promise((resolve) => {
+      const socket = net.connect(devServerPort, "127.0.0.1", () => {
+        socket.write(
+          [
+            "GET /main.js HTTP/1.1",
+            "Host: [::1",
+            "Connection: close",
+            "",
+            "",
+          ].join("\r\n"),
+        );
+      });
+
+      socket.on("data", () => {});
+      socket.on("close", resolve);
+      socket.on("error", resolve);
+    });
+
+    // The server must still be alive: a normal request still succeeds.
+    const status = await new Promise((resolve, reject) => {
+      http
+        .get(`http://localhost:${devServerPort}/main.js`, (res) => {
+          res.resume();
+          resolve(res.statusCode);
+        })
+        .on("error", reject);
+    });
+
+    expect(status).toBe(200);
+  });
+});