Prevent cross-origin webagg connections

scottshambaugh · scottshambaugh · commit b885130fb2f9 · 2026-03-12T16:27:17.000-06:00
diff --git a/lib/matplotlib/backends/backend_webagg.py b/lib/matplotlib/backends/backend_webagg.py
@@ -15,6 +15,7 @@
 import json
 import mimetypes
 from pathlib import Path
+from urllib.parse import urlparse
 import random
 import sys
 import signal
@@ -128,6 +129,17 @@ def get(self, fignum, fmt):
     class WebSocket(tornado.websocket.WebSocketHandler):
         supports_binary = True
 
+        def check_origin(self, origin):
+            parsed = urlparse(origin)
+            # Allow connections where the origin host matches the request
+            # host. This blocks cross-origin WebSocket connections (e.g.
+            # a malicious webpage connecting to the local WebAgg server)
+            # while allowing legitimate same-origin connections. Overrides
+            # Tornado's default method
+            request_host = self.request.host.split(':')[0]
+            origin_host = parsed.hostname
+            return origin_host == request_host
+
         def open(self, fignum):
             self.fignum = int(fignum)
             self.manager = Gcf.get_fig_manager(self.fignum)
diff --git a/lib/matplotlib/tests/test_backend_webagg.py b/lib/matplotlib/tests/test_backend_webagg.py
@@ -1,5 +1,6 @@
 import os
 import sys
+from unittest.mock import MagicMock
 import pytest
 
 import matplotlib.backends.backend_webagg_core
@@ -30,3 +31,22 @@ def test_webagg_fallback(backend):
 def test_webagg_core_no_toolbar():
     fm = matplotlib.backends.backend_webagg_core.FigureManagerWebAgg
     assert fm._toolbar2_class is None
+
+
+def test_websocket_check_origin():
+    """WebSocket should reject cross-origin connections."""
+    pytest.importorskip("tornado")
+    from matplotlib.backends.backend_webagg import WebAggApplication
+
+    ws_cls = WebAggApplication.WebSocket
+
+    ws = ws_cls.__new__(ws_cls)
+    ws.request = MagicMock()
+    ws.request.host = 'localhost:8988'
+
+    # Same origin should be accepted.
+    assert ws.check_origin('http://localhost:8988') is True
+
+    # Cross-origin should be rejected.
+    assert ws.check_origin('http://evil.com') is False
+    assert ws.check_origin('http://127.0.0.1:8988') is False
