lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets

The Gribbit web framework fails to validate the origin of WebSocket connections, allowing requests from unauthorized websites to communicate with the application. This can enable cross-site attacks where malicious sites trick users into sending data to or receiving data from the vulnerable application.

The messageReceived function in HttpRequestHandler.java does not perform origin validation on incoming WebSocket messages, creating a cross-site WebSocket hijacking (CSWSH) vulnerability. An attacker can craft a malicious webpage that establishes a WebSocket connection to the vulnerable server, potentially bypassing same-origin protections and accessing or manipulating data if the user visits the attacker's site while authenticated.