s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Restrict Host-based fetches to Steam CDN names #13

Merged
Ghost merged 1 commits from security/direct-fetch-host-allowlist into main 2026-08-31 18:58:53 -05:00
Conversation 0 Commits 1 Files Changed 4
+116 -5

1 Commits

Author SHA1 Message Date
s1d3sw1ped_bot 8e8e877533 Restrict Host-based origin fetches to Steam CDN names.
CI / vulncheck (pull_request) Successful in 7s
Details
CI / check-and-test (pull_request) Successful in 28s
Details 
When upstream is empty the cache used the client Host as the fetch URL, so any LAN client with a spoofed Steam User-Agent could proxy to literal IPs or arbitrary names. Reject those hosts, stop following upstream redirects, and keep path-only cache keys so real Steam CDNs still share entries.
 2026-08-31 23:56:03 +00:00