fix: block SSRF by rejecting requests to private/internal IPs#528
Open
Yanhu007 wants to merge 1 commit intofloatpane:masterfrom
Open
fix: block SSRF by rejecting requests to private/internal IPs#528Yanhu007 wants to merge 1 commit intofloatpane:masterfrom
Yanhu007 wants to merge 1 commit intofloatpane:masterfrom
Conversation
The HTTP plugin validates URL scheme but does not block requests to private IP ranges. A malicious plugin can probe the local network, access cloud metadata endpoints (169.254.169.254), or hit internal services on localhost. Add a custom DialContext that resolves the target hostname and rejects connections to loopback, private, link-local, and unspecified IP addresses before establishing the connection. Fixes floatpane#505
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #505
Problem
The HTTP plugin validates URL scheme but does not block requests to private/internal IP ranges, enabling SSRF attacks.
Fix
Add a custom
DialContextthat resolves hostnames and rejects connections to loopback, private, link-local, and unspecified IPs before establishing connections.