Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Loading…

Change to make "cljr swank" default to safer localhost #18

Open
wants to merge 1 commit into from

1 participant

@hdurer

Please consider the simple change in my repo.

I never noticed this but http://www.learningclojure.com/2010/09/clojure-swank-server-is-insecure-by.html mentioned that clojure-swank has a dangerous default.

@hdurer hdurer Make swank command default to binding to localhost and add 2dn option…
…al argument which is the hostname to bind to.

The swank command used to bind to '0.0.0.0' by default, i.e. was open
to the world which is a dangerous default.  The default has now been
changed to 'localhost' which is safer.  The command now takes a second
optional argument which is the hostname to bind to -- pass '0.0.0.0'
to get the old behaviour.
94beeab
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Sep 27, 2010
  1. @hdurer

    Make swank command default to binding to localhost and add 2dn option…

    hdurer authored
    …al argument which is the hostname to bind to.
    
    The swank command used to bind to '0.0.0.0' by default, i.e. was open
    to the world which is a dangerous default.  The default has now been
    changed to 'localhost' which is safer.  The command now takes a second
    optional argument which is the hostname to bind to -- pass '0.0.0.0'
    to get the old behaviour.
This page is out of date. Refresh to see the latest.
View
2  src/main/resources/cljr/main.clj
@@ -23,7 +23,7 @@
\newline
"* swingrepl: Starts a Clojure swingrepl." \newline
\newline
- "* swank [port]: Start a local swank server on port 4005 (or as specified)." \newline
+ "* swank [port [host]]: Start a local swank server on localhost port 4005 (or as specified)." \newline
\newline
"* run filename: Runs the given Clojure file." \newline
\newline
View
22 src/main/resources/cljr/swank.clj
@@ -3,11 +3,21 @@
(defn swank
([]
- (swank 4005))
+ (swank nil nil))
([port]
- (cond
- (nil? port) (start-repl 4005)
- (integer? port) (start-repl port)
- (string? port) (start-repl (Integer/parseInt port 10))
- :else (println "Invalid port number: " port))))
+ (swank port nil))
+ ([port host]
+ (let [the-host (cond
+ (nil? host) "localhost"
+ (string? host) host
+ :else (do (println "Invalid hostname:" host)
+ nil))
+ the-port (cond
+ (nil? port) 4005
+ (integer? port) port
+ (string? port) (try (Integer/parseInt port 10)
+ (catch NumberFormatException ex
+ nil)))]
+ (when (and the-host the-port)
+ (start-repl the-port :host the-host)))))
Something went wrong with that request. Please try again.