From 2edf434c69102178042e9444811097dc49ed284e Mon Sep 17 00:00:00 2001 From: Sergey Kazantsev Date: Wed, 8 Jul 2026 15:29:35 +0000 Subject: [PATCH] fix(proxy): Reject out-of-range port numbers in proxy request --- patches/web-server/proxy-uri.diff | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/patches/web-server/proxy-uri.diff b/patches/web-server/proxy-uri.diff index 28424fe..be28869 100644 --- a/patches/web-server/proxy-uri.diff +++ b/patches/web-server/proxy-uri.diff @@ -74,7 +74,7 @@ Index: code-editor-src/src/vs/server/node/proxyServer.ts =================================================================== --- /dev/null +++ code-editor-src/src/vs/server/node/proxyServer.ts -@@ -0,0 +1,200 @@ +@@ -0,0 +1,204 @@ +import proxyServer from "http-proxy"; +import * as http from "http"; +import * as net from "net"; @@ -148,6 +148,9 @@ Index: code-editor-src/src/vs/server/node/proxyServer.ts + return; + } + const port = Number(portRaw); ++ if (port > 65535) { ++ return; ++ } + + let base: string | undefined; + if (proxyPrefix === "ports") { @@ -159,7 +162,8 @@ Index: code-editor-src/src/vs/server/node/proxyServer.ts + targetPathname = targetPathname.replace(/^[/\\][/\\]+/, "/"); + + const target = new URL((targetPathname || "/") + (sourceUrl.search ?? ""), `http://0.0.0.0:${port}`); -+ if (target.hostname !== "0.0.0.0" || target.port !== String(port)) { ++ const effectivePort = target.port || (target.protocol === "http:" ? "80" : "443"); ++ if (target.hostname !== "0.0.0.0" || effectivePort !== String(port)) { + return; + } +