Repository navigation
Check resolver download URLs with safehttp's address policy - #117
Merged
Merged
Conversation
checkMetadataURL had its own private-address check that looked only at the first resolved address and missed CGNAT, unspecified and multicast addresses. It now checks every address with safehttp.HostIPChecker. WithAddressPolicy passes the safehttp.Options of the downloading client, so callers can allow the hosts that client allows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #112.
checkMetadataURLhad its own private-address check: it looked only at the first address the host resolved to, didn't block CGNAT, unspecified or multicast addresses, and had no way to allow anything. It now checks every address withsafehttp.HostIPChecker.fetch.WithAddressPolicy(opts safehttp.Options)gives the resolver the same options as the client that downloads the URLs, so the two agree. Without it the resolver uses safehttp's strict default. The https requirement and the empty-host check stay as they are. A host that doesn't resolve is still left to fail at download.The fetch tests run with
safehttp.EnableLoopbackForTesting, so loopback and private addresses pass the checker there.TestCheckMetadataURLnow uses addresses safehttp always blocks (link-local,0.0.0.0, multicast) instead of127.0.0.1and::1, andTestWithAddressPolicychecks that the resolver keeps the policy it's given. safehttp's own tests cover loopback and private addresses.