Inspect the Origin header and only reflect it if it's a localhost URL. * This prevents remote websites from making cross-origin requests to the * local graph-ui server (the key defense against CORS-based data exfil). */
| 76 | * This prevents remote websites from making cross-origin requests to the |
| 77 | * local graph-ui server (the key defense against CORS-based data exfil). */ |
| 78 | static void update_cors(const cbm_http_req_t *req) { |
| 79 | if (req->origin[0] != '\0' && (cbm_http_path_match(req->origin, "http://localhost:*") || |
| 80 | cbm_http_path_match(req->origin, "http://127.0.0.1:*"))) { |
| 81 | snprintf(g_cors, sizeof(g_cors), |
| 82 | "Access-Control-Allow-Origin: %s\r\n" |
| 83 | "Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS\r\n" |
| 84 | "Access-Control-Allow-Headers: Content-Type\r\n", |
| 85 | req->origin); |
| 86 | } else { |
| 87 | /* No Access-Control-Allow-Origin → browser blocks cross-origin access */ |
| 88 | snprintf(g_cors, sizeof(g_cors), |
| 89 | "Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS\r\n" |
| 90 | "Access-Control-Allow-Headers: Content-Type\r\n"); |
| 91 | } |
| 92 | snprintf(g_cors_json, sizeof(g_cors_json), "%sContent-Type: application/json\r\n", g_cors); |
| 93 | } |
| 94 | |
| 95 | static const char *detect_ui_lang(const char *accept_language) { |
| 96 | if (accept_language && (strstr(accept_language, "zh-CN") || strstr(accept_language, "zh"))) { |
no test coverage detected