Uploaded image for project: 'Nuxeo Drive '
  1. Nuxeo Drive
  2. NXDRIVE-1766

Fix extensions local server to listen on localhost

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 4.1.0
    • Fix Version/s: 4.1.4
    • Component/s: OS Integration

      Description

      Issue

      It is currently listening on 0.0.0.0, which is bad as it opens the computer to external attacks.

      The current implementation is:

      self.host = "localhost"
      self.port = 10650
      # ...
      self.listen(QHostAddress(self.host), self.port)
      

      And it turns out that QHostAddress does not do any DNS lookup:

      >>> from PyQt5.QtNetwork import QHostAddress
      >>> QHostAddress("localhost").toString()
      ''
      >>> QHostAddress("localhost").toIPv4Address()
      0
      
      >>> a = QHostAddress()
      >>> a.setAddress("localhost")
      False
      >>> a.setAddress("127.0.0.1")
      True
      

      So Qt listens on any interfaces by default, 0.0.0.0.

      Fix

      Resolve the address first:

      >>> from PyQt5.QtNetwork import QHostInfo
      >>> info = QHostInfo().fromName("localhost")
      >>> for a in info.addresses():
      ...     print(a.toString())
      ... 
      127.0.0.1
      ::1
      

      And use the IPv4 by default.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 hours
                  2h

                    PagerDuty