{"record":{"id":"f421ad87841b0939","repo":"XX-net/XX-Net","slug":"web-control-ref-s-refuse","errorCode":null,"errorMessage":"web control ref:%s refuse","messagePattern":"web control ref:(.+?) refuse","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/gae_proxy/local/web_control.py","lineNumber":218,"sourceCode":"            data += b'\\r\\n'\n            self.wfile.write(data)\n            xlog.info('%s \"%s %s HTTP/1.1\" 200 -', self.address_string(), self.command, self.path)\n        elif os.path.isfile(filename):\n            if filename.endswith('.pac'):\n                mimetype = 'text/plain'\n            else:\n                mimetype = 'application/octet-stream'\n            #self.send_file(filename, mimetype)\n        else:\n            self.wfile.write(b'HTTP/1.1 404\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n404 Not Found')\n            xlog.info('%s \"%s %s HTTP/1.1\" 404 -', self.address_string(), self.command, self.path)\n\n    def do_POST(self):\n        try:\n            refer = self.headers.getheader('Referer')\n            netloc = urlparse(refer).netloc\n            if not netloc.startswith(\"127.0.0.1\") and not netloc.startswitch(\"localhost\"):\n                xlog.warn(\"web control ref:%s refuse\", netloc)\n                return\n        except:\n            pass\n\n        xlog.debug ('GAEProxy web_control %s %s %s ', self.address_string(), self.command, self.path)\n\n        path = urlparse(self.path).path\n        if path == '/deploy':\n            return self.req_deploy_handler()\n        elif path == \"/config\":\n            return self.req_config_handler()\n        elif path == \"/scan_ip\":\n            return self.req_scan_ip_handler()\n        elif path.startswith(\"/importip\"):\n            return self.req_importip_handler()\n        else:\n            self.wfile.write(b'HTTP/1.1 404\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n404 Not Found')\n            xlog.info('%s \"%s %s HTTP/1.1\" 404 -', self.address_string(), self.command, self.path)","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/gae_proxy/local/web_control.py#L200-L236","documentation":"A POST to the web control endpoint had a Referer whose netloc is neither 127.0.0.1 nor localhost, so it was refused as a cross-origin request. The typo 'startswitch' and bare except mean the check is effectively best-effort: on exception it falls through and allows the request.","triggerScenarios":"POSTing from a page served on a different host/port (Referer netloc mismatch), or with no Referer header (urlparse(None) raises and the except swallows it, so the request proceeds).","commonSituations":"Accessing the web UI via a non-loopback hostname or proxied domain; browser privacy settings stripping Referer (request passes due to the except); CSRF-hardening behavior in newer browsers.","solutions":["Access the control UI via http://127.0.0.1:port directly","Ensure the browser sends the Referer header for same-origin POSTs","Fix the bug: netloc.startswitch -> netloc.startswith so the check actually enforces localhost"],"exampleFix":"// before\nif not netloc.startswith(\"127.0.0.1\") and not netloc.startswitch(\"localhost\"):\n    xlog.warn(\"web control ref:%s refuse\", netloc)\n    return\n\n// after\nif not netloc.startswith(\"127.0.0.1\") and not netloc.startswith(\"localhost\"):\n    xlog.warn(\"web control ref:%s refuse\", netloc)\n    return","handlingStrategy":"validation","validationCode":"# call the control API only from same-origin pages on 127.0.0.1\nurl = 'http://127.0.0.1:%d/%s' % (port, endpoint)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Access the control UI via http://127.0.0.1:port","Allow Referer/cookies for localhost so the check passes","Note: missing Referer bypasses the check due to the bare except — don't rely on it as a security boundary"],"tags":["csrf","referer","web-control","typo-bug"],"backgroundTag":"csrf-referer-check-failed","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}