From f18dde6ad11bc30f77206a14ad31e002a5641fc8 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Thu, 17 Nov 2022 22:04:29 -0800
Subject: [PATCH] ipn/ipnserver: validate Host header on debug ServeHTMLStatus
 status

Updates tailscale/corp#7948

Change-Id: I3a8c64f353af1eeae620812b2700ce4af4fbbc88
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 ipn/ipnserver/server.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ipn/ipnserver/server.go b/ipn/ipnserver/server.go
index 7d1317a55..1cc5037a8 100644
--- a/ipn/ipnserver/server.go
+++ b/ipn/ipnserver/server.go
@@ -27,6 +27,7 @@ import (
 	"sync"
 	"syscall"
 	"time"
+	"unicode"
 
 	"go4.org/mem"
 	"inet.af/peercred"
@@ -1024,7 +1025,17 @@ func (s *Server) localhostHandler(ci connIdentity) http.Handler {
 	})
 }
 
+// ServeHTMLStatus serves an HTML status page at http://localhost:41112/ for
+// Windows and via $DEBUG_LISTENER/debug/ipn when tailscaled's --debug flag
+// is used to run a debug server.
 func (s *Server) ServeHTMLStatus(w http.ResponseWriter, r *http.Request) {
+	// As this is only meant for debug, verify there's no DNS name being used to
+	// access this.
+	if strings.IndexFunc(r.Host, unicode.IsLetter) != -1 {
+		http.Error(w, "invalid host", http.StatusForbidden)
+		return
+	}
+
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	st := s.b.Status()
 	// TODO(bradfitz): add LogID and opts to st?