fix(dev,curl,task): ignore lock file urls that don't match machine

Author: danielroe

packages/nuxt-cli/src/utils/dev-server.ts

@@ -1,4 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs'
+import { isIP } from 'node:net'
+import { networkInterfaces } from 'node:os'
 import { styleText } from 'node:util'
 
 import { join, resolve } from 'pathe'
@@ -51,11 +53,35 @@ export async function findDevServer(cwd: string, buildDir?: string): Promise<Run
   const dir = buildDir ? resolve(cwd, buildDir) : await resolveLockDir(cwd)
 
   const lock = readActiveLock(dir)
-  if (lock?.command === 'dev' && lock.url) {
+  if (lock?.command === 'dev' && lock.url && isOwnAddress(lock.url)) {
     return { url: toLoopback(lock.url), pid: lock.pid, cwd: lock.cwd }
   }
 }
 
+/**
+ * Whether `url` names this machine. A dev server records the address it bound,
+ * which is always local, but the lock file it is read from lives in the project
+ * and so may have been written by someone else. Requests carrying the user's
+ * headers and payloads are only sent to an origin this machine could have bound.
+ */
+function isOwnAddress(url: string): boolean {
+  let hostname: string
+  try {
+    hostname = new URL(url).hostname
+  }
+  catch {
+    return false
+  }
+  if (isLocalHost(hostname)) {
+    return true
+  }
+  const address = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname
+  if (!isIP(address)) {
+    return false
+  }
+  return Object.values(networkInterfaces()).flat().some(info => info?.address === address)
+}
+
 /**
  * A dev server bound to every interface records the wildcard it was given, but
  * that is not an address to connect to: Windows refuses `0.0.0.0` outright, and

packages/nuxt-cli/test/unit/dev-server.spec.ts

@@ -1,5 +1,5 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { networkInterfaces, tmpdir } from 'node:os'
 import process from 'node:process'
 
 import { join } from 'pathe'
@@ -100,6 +100,30 @@ describe('findDevServer', () => {
 
     await expect(findDevServer(cwd, 'custom')).resolves.toMatchObject({ pid: 424242 })
   })
+
+  it('ignores a lock whose URL names another machine', async () => {
+    await writeLock('.nuxt', { url: 'https://attacker.example' })
+    await expect(findDevServer(cwd)).resolves.toBeUndefined()
+
+    await writeLock('.nuxt', { url: 'http://203.0.113.7:3000' })
+    await expect(findDevServer(cwd)).resolves.toBeUndefined()
+  })
+
+  it('accepts a lock bound to one of this machine\'s own addresses', async () => {
+    const address = Object.values(networkInterfaces()).flat().find(info => info && !info.internal && info.family === 'IPv4')?.address
+    if (!address) {
+      return
+    }
+    await writeLock('.nuxt', { url: `http://${address}:3000` })
+
+    await expect(findDevServer(cwd)).resolves.toMatchObject({ url: `http://${address}:3000` })
+  })
+
+  it('accepts a lock bound to IPv6 loopback', async () => {
+    await writeLock('.nuxt', { url: 'http://[::1]:3000' })
+
+    await expect(findDevServer(cwd)).resolves.toMatchObject({ url: 'http://[::1]:3000' })
+  })
 })
 
 describe('findNitroDevWorker', () => {