TraceProcessor: restrict CORS headers to ui.perfetto.dev
Restrict CORS headers of trace_processor --httpd to
ui.perfetto.dev and localhost:10000.
This is to prevent that a malicious site tries to fetch() and
interact with a local trace processor instance.
Test: manual with both ui.perfetto.dev and localhost:10000
Change-Id: Icbbf530b5f3c8e6a4bc138804d43ca4580a7d668
diff --git a/CHANGELOG b/CHANGELOG
index ccb4b8d..be08930 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,7 +2,8 @@
Tracing service and probes:
*
Trace Processor:
- *
+ * Changed CORS headers of --httpd mode to allow only https://ui.perfetto.dev
+ and http://localhost:10000. This affects only CORS-aware browser clients.
UI:
* Fixed ADB connection issues ("unable to reset device") on Windows and Mac.
SDK: