Radman Siddiki R4356th

In versions of Farm before v1.7.6, this security vulnerability is present: Farm's dev (HMR) server does not validate origin when connecting to a WebSocket client. This allows attackers to surveil developers who visit their webpage and potentially steal source code that ends up being leaked by the WebSocket server.

PoC

Code like this would be on the attacker's webpage:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>WebSocket Client Example</title>
</head>
<body>
  <h1>WebSocket Client</h1>
  <div id="status">Connecting...</div>

	/* Copyright 2020-25 Radman Siddiki
	Licensed under the MIT License (https://www.mit.edu/~amini/LICENSE.md) */
	if (location.protocol === "http:") {
	location.replace(location.href.replace("http:", "https:"));
	}