Skip to content

Doc: Add SSRF security warnings to InternetDomainName validation methods #8293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
artahir-dev wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −0
Open

Doc: Add SSRF security warnings to InternetDomainName validation methods #8293

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions guava/src/com/google/common/net/InternetDomainName.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,12 @@ public boolean isPublicSuffix() {
* <p>Note that this method is equivalent to {@link #hasRegistrySuffix()} because all registry
* suffixes are public suffixes <i>and</i> all public suffixes have registry suffixes.
*
* <p><b>Security note:</b> This method performs syntactic validation only and does not perform
* DNS resolution. A syntactically valid domain (e.g., {@code 169.254.169.254.nip.io}) may resolve
* to a private or link-local IP address via wildcard DNS services. Do not use this method as an
* SSRF prevention control. To block SSRF, combine domain validation with IP resolution checks
* against RFC-1918, RFC-5737, and RFC-3927 ranges after DNS resolution.
*
* @since 6.0
*/
public boolean hasPublicSuffix() {
Expand All @@ -380,6 +386,12 @@ public boolean hasPublicSuffix() {
* the domain, though even that depends on individual browsers' implementations of cookie
* controls. See <a href="http://www.ietf.org/rfc/rfc2109.txt">RFC 2109</a> for details.
*
* <p><b>Security note:</b> This method performs syntactic validation only and does not perform
* DNS resolution. A syntactically valid domain (e.g., {@code 169.254.169.254.nip.io}) may resolve
* to a private or link-local IP address via wildcard DNS services. Do not use this method as an
* SSRF prevention control. To block SSRF, combine domain validation with IP resolution checks
* against RFC-1918, RFC-5737, and RFC-3927 ranges after DNS resolution.
*
* @since 6.0
*/
public boolean isUnderPublicSuffix() {
Expand Down Expand Up @@ -600,6 +612,12 @@ public InternetDomainName child(String leftParts) {
* }
* }
*
* <p><b>Security note:</b> This method performs syntactic validation only and does not perform
* DNS resolution. A syntactically valid domain (e.g., {@code 169.254.169.254.nip.io}) may resolve
* to a private or link-local IP address via wildcard DNS services. Do not use this method as an
* SSRF prevention control. To block SSRF, combine domain validation with IP resolution checks
* against RFC-1918, RFC-5737, and RFC-3927 ranges after DNS resolution.
*
* @since 8.0 (previously named {@code isValidLenient})
*/
public static boolean isValid(String name) {
Expand Down