From c56d1bac6bc439e95b1e088ad7407bb9fdbbbffe Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Mon, 10 Aug 2026 01:23:24 -0400 Subject: [PATCH] fix(server): validate detected Tailscale addresses --- src/node-server/server-address-discovery.test.ts | 10 ++++++++++ src/node-server/server-address-discovery.ts | 5 +++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/src/node-server/server-address-discovery.test.ts b/src/node-server/server-address-discovery.test.ts index 1f1590e38ef..96e3bcbf66b 100644 --- a/src/node-server/server-address-discovery.test.ts +++ b/src/node-server/server-address-discovery.test.ts @@ -23,4 +23,14 @@ describe('discoverServerPairingAddress', () => { source: 'loopback' }) }) + + it.each(['999.999.999.999', '256.0.0.1', '01.2.3.4'])( + 'stays on loopback for invalid Tailscale IPv4 output %s', + async (address) => { + await expect(discoverServerPairingAddress(undefined, async () => address)).resolves.toEqual({ + address: '127.0.0.1', + source: 'loopback' + }) + } + ) }) diff --git a/src/node-server/server-address-discovery.ts b/src/node-server/server-address-discovery.ts index 0171ba5a6d9..598378406bb 100644 --- a/src/node-server/server-address-discovery.ts +++ b/src/node-server/server-address-discovery.ts @@ -1,4 +1,5 @@ import { execFile } from 'node:child_process' +import { isIPv4 } from 'node:net' const TAILSCALE_ADDRESS_TIMEOUT_MS = 1_500 @@ -10,7 +11,7 @@ export async function discoverServerPairingAddress( return { address: explicitAddress, source: 'explicit' } } const tailscaleAddress = await readTailscaleAddress() - return tailscaleAddress + return tailscaleAddress && isIPv4(tailscaleAddress) ? { address: tailscaleAddress, source: 'tailscale' } : { address: '127.0.0.1', source: 'loopback' } } @@ -27,7 +28,7 @@ function readTailscaleIpv4(): Promise { return } const address = stdout.trim().split(/\s+/)[0] - resolve(/^\d{1,3}(?:\.\d{1,3}){3}$/.test(address ?? '') ? address : null) + resolve(address ?? null) } ) })