Chromium1337

An issue allows an attacker to read any file on the server that the web server's user can access when the AllowArbitraryServer configuration setting is set to true. This is related to the mysql.allow local infile PHP configuration and the inadvertent ignoring of `options(MYSQLI OPT LOCAL INFILE)` calls.

An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement (HMR). This enables anyone to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1 connection from any origin. The vulnerability can be exploited by finding the random TCP port number used by the WebSocket server, which can be discovered by connecting to http://127.0.0.1 and examining the source code for the "new WebSocket" line.

An issue in the WebSocket server used for Hot Module Replacement (HMR) allows attackers to steal a developer's source code because the origin of requests is not validated. This enables a remote attacker to receive HMR messages sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

The issue allows remote attackers to redirect users to arbitrary websites, potentially leading to phishing attacks. This is achieved via an initial `/` substring in the `redirect to` parameter. The `isValidRedirect` function in `routes/user/auth.go` is related to this issue.