[Security] DNS rebinding attack against webtorrent

[diracdeltas]

our webtorrent integration may be vulnerable to the DNS rebinding attack described in transmission/transmission#468. the torrent server uses CORS but it doesn't check the Host header.

impact: remote sites may see what a user is torrenting

[diracdeltas]

this does affect webtorrent but the impact is relatively low - the attacker can see the torrented files. however this is usually possible for torrents anyway (unless you're using a private tracker) since the attacker can just join the swarm.

[diracdeltas]

general issue: #12671

[bsclifton]

Still waiting on merge upstream... moving to tentative 0.20.x hotfix 1 milestone

[diracdeltas]

upstream webtorrent fix has been merged, we need to add an option to webtorrent-remote though: dcposch/webtorrent-remote#9.

[feross]

I think the hostname option can be specified by the webtorrent-remote user and it will be passed through to webtorrent.

You can see how opts from torrent.createServer(opts) gets passed through in this commit where it was added: dcposch/webtorrent-remote@5b0cec4

So, the solution to this should just be to change Brave's torrent.createServer(opts) call to include a opts.hostname option, unless I'm missing something.