From 95cc8896bd790f179dbe7d72c81518a12b270e0b Mon Sep 17 00:00:00 2001 From: khawarahemad Date: Tue, 25 Aug 2026 23:28:03 +0530 Subject: [PATCH] fix(security): bind internal API and editor servers to loopback --- src/AppCore/APIServer.ts | 2 +- src/AppCore/MessageEditorServer.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/AppCore/APIServer.ts b/src/AppCore/APIServer.ts index d5a0a5f..8545ed5 100644 --- a/src/AppCore/APIServer.ts +++ b/src/AppCore/APIServer.ts @@ -93,7 +93,7 @@ export default async function startAppServer (): Promise { resolve(address.port); logger.log(`API Server listening on https://localhost:${address.port}`); }; - server.listen(0).once("listening", callback); + server.listen(0, "127.0.0.1").once("listening", callback); server.on("error", reject); }); } diff --git a/src/AppCore/MessageEditorServer.ts b/src/AppCore/MessageEditorServer.ts index 05bb3c3..258b448 100644 --- a/src/AppCore/MessageEditorServer.ts +++ b/src/AppCore/MessageEditorServer.ts @@ -26,7 +26,7 @@ app.use(express.static(Constants.EditorHTMLFolderPath)); export default async function startEditor (): Promise { return new Promise((resolve, reject) => { - const server = app.listen(0, () => { + const server = app.listen(0, "127.0.0.1", () => { const { port } = server.address() as AddressInfo; resolve(port); logger.log(`API Server listening on http://localhost:${port}`);