internal: add validation for referers and accept-encoding

Signed-off-by: Xe Iaso <me@xeiaso.net>

1 files changed, 7 insertions, 1 deletions

diff --git a/internal/referer.go b/internal/referer.go
index ec8c2be..3a7d16f 100644
--- a/internal/referer.go
+++ b/internal/referer.go
@@ -3,6 +3,7 @@ package internal
 import (
 	"expvar"
 	"net/http"
+	"net/url"
 
 	"tailscale.com/metrics"
 )
@@ -17,7 +18,12 @@ func init() {
 
 func RefererMiddleware(next http.Handler) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		referers.Add(r.Header.Get("Referer"), 1)
+		if referer := r.Header.Get("Referer"); referer != "" {
+			_, err := url.Parse(referer)
+			if err == nil {
+				referers.Add(referer, 1)
+			}
+		}
 		next.ServeHTTP(w, r)
 	}
 }