RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: browse server lock fails when .gstack/ dir missing 

acquireServerLock() tried to create a lock file in .gstack/browse.json.lock
but ensureStateDir() was only called inside startServer() — after lock
acquisition. When .gstack/ didn't exist, openSync threw ENOENT, the catch
returned null, and every invocation thought another process held the lock.

Fix: call ensureStateDir() before acquireServerLock() in ensureServer().

Also skip DNS rebinding resolution for localhost/private IPs to eliminate
unnecessary latency in concurrent E2E test sessions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Garry Tan 2026-03-23 15:27:11 -07:00
parent 328ec924a2
commit 9d7fb1c3c2
No known key found for this signature in database
GPG Key ID: C1F69E85C74EFE1D
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
browse/src/cli.ts
View File

@ -262,6 +262,9 @@ async function ensureServer(): Promise<ServerState> {
} }
} }
// Ensure state directory exists before lock acquisition (lock file lives there)
ensureStateDir(config);
// Acquire lock to prevent concurrent restart races (TOCTOU) // Acquire lock to prevent concurrent restart races (TOCTOU)
const releaseLock = acquireServerLock(); const releaseLock = acquireServerLock();
if (!releaseLock) { if (!releaseLock) {

8
browse/src/url-validation.ts
View File

@ -82,8 +82,12 @@ export async function validateNavigationUrl(url: string): Promise<void> {
); );
} }
// DNS rebinding protection: resolve hostname and check if it points to metadata IPs // DNS rebinding protection: resolve hostname and check if it points to metadata IPs.
if (await resolvesToBlockedIp(hostname)) { // Skip for loopback/private IPs — they can't be DNS-rebinded and the async DNS
// resolution adds latency that breaks concurrent E2E tests under load.
const isLoopback = hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
const isPrivateNet = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/.test(hostname);
if (!isLoopback && !isPrivateNet && await resolvesToBlockedIp(hostname)) {
throw new Error( throw new Error(
`Blocked: ${parsed.hostname} resolves to a cloud metadata IP. Possible DNS rebinding attack.` `Blocked: ${parsed.hostname} resolves to a cloud metadata IP. Possible DNS rebinding attack.`
); );