s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Restrict Host-based fetches to Steam CDN names #13

Merged
Ghost merged 1 commits from security/direct-fetch-host-allowlist into main 2026-08-31 18:58:53 -05:00
Conversation 0 Commits 1 Files Changed 4
+116 -5
Ghost commented 2026-08-31 18:56:18 -05:00
Copy Link
Copy Source

Restricts Host-based origin fetches (empty upstream) to Steam CDN hostnames and stops following upstream redirects.

Why

Default config listens on :80 with empty upstream and treats request Host as the origin. A spoofed Steam User-Agent was enough to proxy to LAN IPs / arbitrary names and to fill path-only cache keys.

Change

  • hostAllowedForDirectFetch: allow steamcontent.com, steampowered.com, steamstatic.com (and subdomains); reject empty Host and literal IPs.
  • CheckRedirect always returns http.ErrUseLastResponse (chunk/manifest traffic is expected to be 200).
  • Cache key remains path-only so real Steam CDN hostnames still share entries.

Test plan

  • go test ./steamcache/ ./config/
  • make test / CI on this PR
  • LAN: Steam download still hits the cache with Host lancache.steamcontent.com or *.steamcontent.com
  • Confirm a Steam-UA GET with Host 127.0.0.1 or evil.example returns 400
Restricts Host-based origin fetches (empty `upstream`) to Steam CDN hostnames and stops following upstream redirects. ## Why Default config listens on `:80` with empty `upstream` and treats request Host as the origin. A spoofed Steam User-Agent was enough to proxy to LAN IPs / arbitrary names and to fill path-only cache keys. ## Change - `hostAllowedForDirectFetch`: allow `steamcontent.com`, `steampowered.com`, `steamstatic.com` (and subdomains); reject empty Host and literal IPs. - `CheckRedirect` always returns `http.ErrUseLastResponse` (chunk/manifest traffic is expected to be 200). - Cache key remains path-only so real Steam CDN hostnames still share entries. ## Test plan - [x] `go test ./steamcache/ ./config/` - [ ] `make test` / CI on this PR - [ ] LAN: Steam download still hits the cache with Host `lancache.steamcontent.com` or `*.steamcontent.com` - [ ] Confirm a Steam-UA GET with Host `127.0.0.1` or `evil.example` returns 400
Ghost added 1 commit 2026-08-31 18:56:18 -05:00
Restrict Host-based origin fetches to Steam CDN names.
CI / vulncheck (pull_request) Successful in 7s
Details
CI / check-and-test (pull_request) Successful in 28s
Details
8e8e877533 
When upstream is empty the cache used the client Host as the fetch URL, so any LAN client with a spoofed Steam User-Agent could proxy to literal IPs or arbitrary names. Reject those hosts, stop following upstream redirects, and keep path-only cache keys so real Steam CDNs still share entries.
Ghost merged commit 81b3a7df53 into main 2026-08-31 18:58:53 -05:00
Ghost deleted branch security/direct-fetch-host-allowlist 2026-08-31 18:58:53 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 draft
Draft for review — do not merge without Eva review
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ash blake eva linus moss pike s1d3sw1ped
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: s1d3sw1ped/steamcache2#13
Delete Branch "security/direct-fetch-host-allowlist"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?