cli: Only serve the anonymous dashboard on localhost URLs (#60059)

GitOrigin-RevId: b7a334db5a741f60c08a5649dc1f85c8232cdd11

Author: Nicolapps

src/cli/lib/localDeployment/dashboard.ts

@@ -57,6 +57,12 @@ export async function handleDashboard(
     ctx,
     dashboardPort,
     async (request, response) => {
+      if (!isLoopbackHost(request.headers.host, dashboardPort)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+      }
+
       const pathname = new URL(
         request.url ?? "/",
         // We only want to extract the pathname so the base doesn’t matter
@@ -96,6 +102,19 @@ export async function handleDashboard(
   };
 }
 
+/**
+ * The dashboard is only meant to be opened at the URL the CLI prints, so
+ * requests addressed to any other hostname are not served, even if that
+ * hostname resolves to 127.0.0.1.
+ */
+export function isLoopbackHost(host: string | undefined, port: number) {
+  const normalizedHost = host?.toLowerCase();
+  return (
+    normalizedHost === `127.0.0.1:${port}` ||
+    normalizedHost === `localhost:${port}`
+  );
+}
+
 async function reportSelfHostedEvent(
   ctx: Context,
   {