fix(security): escape font CDN URL and tighten WS origin check

- Escape font.cdnUrl with escapeAttr() in build.ts HTML injection
- Reject missing Origin header on non-loopback hosts in WS validation

Author: connorads

build.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
-import { generatePwaHtml } from './src/pwa/meta-tags'
+import { escapeAttr, generatePwaHtml } from './src/pwa/meta-tags'
 import type { RemobiConfig } from './src/types'
 import { readStdin, sleep, spawnProcess } from './src/util/node-compat'
 
@@ -113,7 +113,7 @@ const WS_INTERCEPTOR =
 
 /** Inject remobi overlay into ttyd's HTML */
 export function injectOverlay(html: string, js: string, css: string, config: RemobiConfig): string {
-	const fontLink = `<link rel="preload" href="${config.font.cdnUrl}" as="style" onload="this.rel='stylesheet'">`
+	const fontLink = `<link rel="preload" href="${escapeAttr(config.font.cdnUrl)}" as="style" onload="this.rel='stylesheet'">`
 	const viewport =
 		'<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, viewport-fit=cover">'
 	const styleTag = `<style>${css}</style>`

src/serve.ts

@@ -67,7 +67,8 @@ export function isAllowedWebSocketOrigin(
 	hostHeader: string | undefined,
 ): boolean {
 	if (originHeader === undefined) {
-		return true
+		const hostname = (hostHeader ?? '').replace(/:\d+$/, '')
+		return isLoopbackHost(hostname)
 	}
 	if (hostHeader === undefined) {
 		return false

tests/serve.test.ts

@@ -93,8 +93,15 @@ describe('isAllowedWebSocketOrigin', () => {
 		expect(isAllowedWebSocketOrigin('https://term.example.ts.net', undefined)).toBe(false)
 	})
 
-	test('allows requests without an origin header', () => {
+	test('allows requests without an origin header on loopback', () => {
 		expect(isAllowedWebSocketOrigin(undefined, 'localhost:7681')).toBe(true)
+		expect(isAllowedWebSocketOrigin(undefined, '127.0.0.1:7681')).toBe(true)
+	})
+
+	test('rejects requests without an origin header on non-loopback', () => {
+		expect(isAllowedWebSocketOrigin(undefined, 'term.example.ts.net')).toBe(false)
+		expect(isAllowedWebSocketOrigin(undefined, '0.0.0.0:7681')).toBe(false)
+		expect(isAllowedWebSocketOrigin(undefined, undefined)).toBe(false)
 	})
 })