fix(security): docsify serve should only listen on localhost

README.md

@@ -88,6 +88,10 @@ docsify serve <path> [--open false] [--port 3000]
   - Type: number
   - Default: `3000`
   - Description: Choose a listen port, defaults to `3000`.
+- `--ip` option:
+  - Type: string
+  - Default: `127.0.0.1`
+  - Description: Choose a listen IP, defaults to `127.0.0.1`.
 
 ### `generate` command
 

lib/cli.js

@@ -67,6 +67,13 @@ require('yargs')
           requiresArg: true,
           type: 'number'
         },
+        ip: {
+          default: '127.0.0.1',
+          desc: chalk.gray(y18n.__('serve.ip')),
+          nargs: 1,
+          requiresArg: true,
+          type: 'string'
+        },
         'livereload-port': {
           alias: 'P',
           default: 35729,
@@ -83,7 +90,7 @@ require('yargs')
           type: 'string'
         }
       }),
-    handler: argv => run.serve(argv.path, argv.open, argv.port, argv.P, argv.i)
+    handler: argv => run.serve(argv.path, argv.open, argv.port, argv.ip, argv.P, argv.i)
   })
   .command({
     command: 'start <path>',

lib/commands/serve.js

@@ -13,6 +13,7 @@ module.exports = function (
   path,
   openInBrowser,
   port,
+  ip,
   livereloadPort,
   indexName
 ) {
@@ -46,7 +47,7 @@ module.exports = function (
         })
       )
       server.use(serveStatic(path, {index: indexName}))
-      server.listen(port)
+      server.listen(port, ip)
       lrserver
         .createServer({
           extraExts: ['md'],
@@ -56,15 +57,16 @@ module.exports = function (
         .watch(path)
 
       if (openInBrowser) {
-        open(`http://localhost:${port}`)
+        const host = ip === '0.0.0.0' ? 'localhost' : ip
+        open(`http://${host}:${port}`)
       }
 
       const msg =
         '\nServing ' +
         chalk.green(`${path}`) +
         ' now.\n' +
         'Listening at ' +
-        chalk.green(`http://localhost:${port}`) +
+        chalk.green(`http://${ip}:${port}`) +
         '\n'
       console.log(msg)
     })

tools/locales/de.json

@@ -9,6 +9,7 @@
   "serve": "Lasse lokalen Server zur Webseitenvorschau laufen.",
   "serve.open": "Dokumentation im Standardbrowser öffnen. Um explizit --open auf false zu setzen, kannst du --no-open verwenden.",
   "serve.port": "Listen port.",
+  "serve.ip": "Listen IP.",
   "serve.indexname": "Custom filename instead of index.html to serve by default",
   "livereload.port": "livereload Listen port.",
   "usage": "Anwendung",

tools/locales/en.json

@@ -9,6 +9,7 @@
   "serve": "Run local server to preview site.",
   "serve.open": "Open docs in default browser. To explicitly set --open to false you may use --no-open.",
   "serve.port": "Listen port.",
+  "serve.ip": "Listen IP.",
   "serve.indexname": "Custom filename instead of index.html to serve by default",
   "generate": "Docsify's generators",
   "generate.sidebar": "Generate sidebar file",

tools/locales/zh.json

@@ -9,6 +9,7 @@
   "serve": "本地预览",
   "serve.open": "自动打开浏览器",
   "serve.port": "设置端口",
+  "serve.ip": "Listen IP.",
   "serve.indexname": "Custom filename instead of index.html to serve by default",
   "generate": "Docsify的生成器",
   "generate.sidebar": "生成侧边栏文件",