[release-branch.go1.2] go.tools/playground/socket: require origin to set up socket handler

««« CL 95030044 / bda3619e7a2c
go.tools/playground/socket: require origin to set up socket handler

This prevents cross-site request forgery attacks.

LGTM=rsc
R=rsc
CC=golang-codereviews
https://golang.org/cl/95030044
»»»

TBR=rsc
CC=golang-dev
https://golang.org/cl/97040044

README

@@ -8,3 +8,4 @@ Packages include a type-checker for Go and an implementation of the Single Stati
 Assignment (SSA) representation for Go programs.
 
 To submit changes to this repository, see http://golang.org/doc/contribute.html.
+

blog/blog.go

@@ -36,8 +36,9 @@ type Config struct {
 	GodocURL string // The base URL of godoc (for menu bar; no trailing slash).
 	Hostname string // Server host name, used for rendering ATOM feeds.
 
-	HomeArticles int // Articles to display on the home page.
-	FeedArticles int // Articles to include in Atom and JSON feeds.
+	HomeArticles int    // Articles to display on the home page.
+	FeedArticles int    // Articles to include in Atom and JSON feeds.
+	FeedTitle    string // The title of the Atom XML feed
 
 	PlayEnabled bool
 }
@@ -117,7 +118,7 @@ func NewServer(cfg Config) (*Server, error) {
 	}
 
 	// Set up content file server.
-	s.content = http.FileServer(http.Dir(cfg.ContentPath))
+	s.content = http.StripPrefix(s.cfg.BasePath, http.FileServer(http.Dir(cfg.ContentPath)))
 
 	return s, nil
 }
@@ -258,11 +259,11 @@ func (s *Server) loadDocs(root string) error {
 // atomFeed field.
 func (s *Server) renderAtomFeed() error {
 	var updated time.Time
-	if len(s.docs) > 1 {
+	if len(s.docs) > 0 {
 		updated = s.docs[0].Time
 	}
 	feed := atom.Feed{
-		Title:   "The Go Programming Language Blog",
+		Title:   s.cfg.FeedTitle,
 		ID:      "tag:" + s.cfg.Hostname + ",2013:" + s.cfg.Hostname,
 		Updated: atom.Time(updated),
 		Link: []atom.Link{{

godoc/static/godoc.html

@@ -72,7 +72,7 @@ func main() {
 
 <div id="footer">
 Build version {{html .Version}}.<br>
-Except as <a href="http://code.google.com/policies.html#restrictions">noted</a>,
+Except as <a href="https://developers.google.com/site-policies#restrictions">noted</a>,
 the content of this page is licensed under the
 Creative Commons Attribution 3.0 License,
 and code is licensed under a <a href="/LICENSE">BSD license</a>.<br>

godoc/static/static.go

@@ -222,7 +222,7 @@ func main() {
 
 <div id="footer">
 Build version {{html .Version}}.<br>
-Except as <a href="http://code.google.com/policies.html#restrictions">noted</a>,
+Except as <a href="https://developers.google.com/site-policies#restrictions">noted</a>,
 the content of this page is licensed under the
 Creative Commons Attribution 3.0 License,
 and code is licensed under a <a href="/LICENSE">BSD license</a>.<br>

playground/socket/socket.go

@@ -22,6 +22,8 @@ import (
 	"io"
 	"io/ioutil"
 	"log"
+	"net/http"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -35,9 +37,6 @@ import (
 	"code.google.com/p/go.net/websocket"
 )
 
-// Handler implements a WebSocket handler for a client connection.
-var Handler = websocket.Handler(socketHandler)
-
 // Environ provides an environment when a binary, such as the go tool, is
 // invoked.
 var Environ func() []string = os.Environ
@@ -65,6 +64,30 @@ type Options struct {
 	Race bool // use -race flag when building code (for "run" only)
 }
 
+// NewHandler returns a websocket server which checks the origin of requests.
+func NewHandler(origin *url.URL) websocket.Server {
+	return websocket.Server{
+		Config:    websocket.Config{Origin: origin},
+		Handshake: handshake,
+		Handler:   websocket.Handler(socketHandler),
+	}
+}
+
+// handshake checks the origin of a request during the websocket handshake.
+func handshake(c *websocket.Config, req *http.Request) error {
+	o, err := websocket.Origin(c, req)
+	if err != nil {
+		log.Println("bad websocket origin:", err)
+		return websocket.ErrBadWebSocketOrigin
+	}
+	ok := c.Origin.Scheme == o.Scheme && c.Origin.Host == o.Host
+	if !ok {
+		log.Println("bad websocket origin:", o)
+		return websocket.ErrBadWebSocketOrigin
+	}
+	return nil
+}
+
 // socketHandler handles the websocket connection for a given present session.
 // It handles transcoding Messages to and from JSON format, and starting
 // and killing processes.