added support for redirecting directly if the Host header is present

chrissxMedia · Aug 14, 2020 · 296d065 · 296d065
1 parent ea78678
commit 296d065
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 13 deletions.
diff --git a/install.sh b/install.sh
@@ -1,8 +1,8 @@
-curl -Lo /usr/bin/redirector https://github.com/chrissxYT/chrissx.de-80/releases/download/2.1/redirector-arm
+curl -Lo /usr/bin/redirector https://github.com/chrissxYT/chrissx.de-80/releases/download/3.0/redirector-arm
 chmod +x /usr/bin/redirector
 
 echo "[Unit]
-Description=A simple static HTML
+Description=A simple HTTPS upgrador
 
 [Service]
 Type=simple

diff --git a/redirector.go b/redirector.go
@@ -4,23 +4,37 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"strings"
 )
 
 func main() {
+	var response = "<html>"
+	response += "<head>"
+	response += "<title>Redirecting...</title>"
+	response += "<script>"
+	response += "window.location.protocol = 'https:'"
+	response += "</script>"
+	response += "</head>"
+	response += "<body>"
+	response += "Just switch to https up there ↑"
+	response += "</body>"
+	response += "</html>"
 	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		log.Printf("Got an %s request from %s: %s (%s)",
 			r.Proto, r.RemoteAddr, r.URL, r.Host)
-		fmt.Fprintf(w, "<html>")
-		fmt.Fprintf(w, "<head>")
-		fmt.Fprintf(w, "<title>Redirecting...</title>")
-		fmt.Fprintf(w, "<script>")
-		fmt.Fprintf(w, "window.location.protocol = 'https:'")
-		fmt.Fprintf(w, "</script>")
-		fmt.Fprintf(w, "</head>")
-		fmt.Fprintf(w, "<body>")
-		fmt.Fprintf(w, "Just switch to https up there ↑")
-		fmt.Fprintf(w, "</body>")
-		fmt.Fprintf(w, "</html>")
+		// this matches urls like chrissx.de.evil.com, but
+		// there are no ways to exploit that (except if there
+		// are other misdesigns)
+		if strings.Contains(r.Host, "chrissx.de") ||
+			strings.Contains(r.Host, "chrissx.eu") ||
+			strings.Contains(r.Host, "zerm.eu") ||
+			strings.Contains(r.Host, "zerm.link") {
+			var url = r.URL
+			url.Scheme = "https"
+			w.Header().Add("Location", url.String())
+			w.WriteHeader(307)
+		}
+		fmt.Fprintf(w, response)
 	})
 
 	http.ListenAndServe(":80", nil)