s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues Pull requests Projects Releases 34 Packages Wiki Activity Actions

Restrict Host-based fetches to Steam CDN names #13

Merged
Ghost merged 1 commit from security/direct-fetch-host-allowlist into main 2026-08-31 23:58:53 +00:00
Conversation 0 Commits 1 Files changed 4 +116 -5
Ghost commented 2026-08-31 23:56:18 +00:00
Copy link

Restricts Host-based origin fetches (empty upstream) to Steam CDN hostnames and stops following upstream redirects.

Why

Default config listens on :80 with empty upstream and treats request Host as the origin. A spoofed Steam User-Agent was enough to proxy to LAN IPs / arbitrary names and to fill path-only cache keys.

Change

  • hostAllowedForDirectFetch: allow steamcontent.com, steampowered.com, steamstatic.com (and subdomains); reject empty Host and literal IPs.
  • CheckRedirect always returns http.ErrUseLastResponse (chunk/manifest traffic is expected to be 200).
  • Cache key remains path-only so real Steam CDN hostnames still share entries.

Test plan

  • go test ./steamcache/ ./config/
  • make test / CI on this PR
  • LAN: Steam download still hits the cache with Host lancache.steamcontent.com or *.steamcontent.com
  • Confirm a Steam-UA GET with Host 127.0.0.1 or evil.example returns 400
Restricts Host-based origin fetches (empty `upstream`) to Steam CDN hostnames and stops following upstream redirects. ## Why Default config listens on `:80` with empty `upstream` and treats request Host as the origin. A spoofed Steam User-Agent was enough to proxy to LAN IPs / arbitrary names and to fill path-only cache keys. ## Change - `hostAllowedForDirectFetch`: allow `steamcontent.com`, `steampowered.com`, `steamstatic.com` (and subdomains); reject empty Host and literal IPs. - `CheckRedirect` always returns `http.ErrUseLastResponse` (chunk/manifest traffic is expected to be 200). - Cache key remains path-only so real Steam CDN hostnames still share entries. ## Test plan - [x] `go test ./steamcache/ ./config/` - [ ] `make test` / CI on this PR - [ ] LAN: Steam download still hits the cache with Host `lancache.steamcontent.com` or `*.steamcontent.com` - [ ] Confirm a Steam-UA GET with Host `127.0.0.1` or `evil.example` returns 400
Restrict Host-based origin fetches to Steam CDN names.
All checks were successful
CI / vulncheck (pull_request) Successful in 7s
Details
CI / check-and-test (pull_request) Successful in 28s
Details
8e8e877533 
When upstream is empty the cache used the client Host as the fetch URL, so any LAN client with a spoofed Steam User-Agent could proxy to literal IPs or arbitrary names. Reject those hosts, stop following upstream redirects, and keep path-only cache keys so real Steam CDNs still share entries.
Ghost merged commit 81b3a7df53 into main 2026-08-31 23:58:53 +00:00
Ghost deleted branch security/direct-fetch-host-allowlist 2026-08-31 23:58:53 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
blocked
Stuck. The assignee needs a decision or an unblock; see the latest comment.

  
bug
Something is not working

  
draft
Draft for review — do not merge without Eva review

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
blocked
bug
draft
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
s1d3sw1ped/steamcache2!13
No description provided.