مراية لـ
https://github.com/postalserver/postal.git
تم المزامنة 2026-07-22 10:12:31 +00:00
11c9814474
Webhook and HTTP message endpoint deliveries both flow through Postal::HTTP, which parsed the user-supplied URL and connected to its host with no address validation. An authenticated user could point a webhook or endpoint at a private, loopback or link-local address (e.g. 127.0.0.1, 169.254.169.254 cloud metadata, RFC1918 hosts) and make the server issue requests into its own internal network. Add Postal::HTTP::AddressGuard, which resolves the destination host and rejects private/loopback/link-local/reserved/multicast IPv4 and IPv6 addresses, then pins the connection to the validated address so it cannot be redirected via a DNS-rebinding race. Administrators can permit specific destinations via the new postal.allowed_request_destinations config option (hostnames or IP/CIDR ranges). Address selection only uses families this server can actually reach so we do not pin to an IPv6 address on a host without IPv6 connectivity; IPv4 is preferred for predictability. HTTPEndpoint now validates that its URL is a well-formed HTTP(S) URL with a host.
12 أسطر
356 B
Ruby
12 أسطر
356 B
Ruby
# frozen_string_literal: true
|
|
|
|
module Postal
|
|
module HTTP
|
|
# Raised when an outbound request would be sent to an address that is not
|
|
# permitted (a private, loopback, link-local or otherwise reserved address
|
|
# that has not been explicitly allowlisted). Used as an SSRF guard.
|
|
class BlockedDestinationError < StandardError
|
|
end
|
|
end
|
|
end
|