Do not include port number in loopback address check

brycekahle · brycekahle · commit 110788c1e642 · 2020-08-02T15:37:12.000-04:00
diff --git a/lib/main.js b/lib/main.js
@@ -78,7 +78,7 @@ function SockJS(url, protocols, options) {
   // Step 2 - don't allow secure origin with an insecure protocol
   if (loc.protocol === 'https:' && !secure) {
     // exception is 127.0.0.0/8 and ::1 urls
-    if (!urlUtils.isLoopbackAddr(parsedUrl.host)) {
+    if (!urlUtils.isLoopbackAddr(parsedUrl.hostname)) {
       throw new Error('SecurityError: An insecure SockJS connection may not be initiated from a page loaded over HTTPS');
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ function SockJS(url, protocols, options) {`
`78`	`78`	`// Step 2 - don't allow secure origin with an insecure protocol`
`79`	`79`	`if (loc.protocol === 'https:' && !secure) {`
`80`	`80`	`// exception is 127.0.0.0/8 and ::1 urls`
`81`		`- if (!urlUtils.isLoopbackAddr(parsedUrl.host)) {`
	`81`	`+ if (!urlUtils.isLoopbackAddr(parsedUrl.hostname)) {`
`82`	`82`	`throw new Error('SecurityError: An insecure SockJS connection may not be initiated from a page loaded over HTTPS');`
`83`	`83`	`}`
`84`	`84`	`}`