Enforce localhost-only security and single-user/personal use-cases only

This commit is contained in:
Lars Baunwall 2025-10-05 13:21:08 +02:00
parent 93395e5711
commit f7273d7d57
No known key found for this signature in database
4 changed files with 110 additions and 136 deletions

View file

@ -1,8 +1,10 @@
import * as vscode from 'vscode';
export const LOOPBACK_HOST = '127.0.0.1' as const;
export interface BridgeConfig {
readonly enabled: boolean;
readonly host: string;
readonly host: typeof LOOPBACK_HOST;
readonly port: number;
readonly token: string;
readonly historyWindow: number;
@ -14,7 +16,7 @@ export const getBridgeConfig = (): BridgeConfig => {
const cfg = vscode.workspace.getConfiguration('bridge');
const resolved = {
enabled: cfg.get('enabled', false),
host: cfg.get('host', '127.0.0.1'),
host: LOOPBACK_HOST,
port: cfg.get('port', 0),
token: cfg.get('token', '').trim(),
historyWindow: cfg.get('historyWindow', 3),

View file

@ -44,8 +44,7 @@ export const startServer = async (): Promise<void> => {
});
// Verbose logging middleware
const cfg = getBridgeConfig();
if (cfg.verbose) {
if (config.verbose) {
app.use((req, res, next) => {
verbose(`${req.method} ${req.url}`);
next();