CVE-2023-26114: code-server vulnerable to Missing Origin Validation in WebSockets

The vulnerability stemmed from missing origin validation in WebSocket handlers across multiple endpoints. The patch added 'ensureOrigin' checks to these routes, which: 1) validate() Origin header against Host/X-Forwarded headers 2) Handle Forwarded header parsing 3) Block requests with mismatched origins. The vulnerable versions lacked these checks in their WebSocket handlers, particularly visible in routes like domainProxy.ts (lines 78-86), pathProxy.ts (line 50), and vscode.ts (line 173) where WebSocket handlers were modified to add origin validation middleware. The absence of these checks in pre-4.10.1 versions allowed cross-origin WebSocket hijacking.