Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CRE-47] Add safeurl to protect against SSRF #15885

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

[CRE-47] Add safeurl to protect against SSRF #15885

wants to merge 1 commit into from
+182 −19

Conversation

cedric-cordenier
Copy link
Contributor

@cedric-cordenier cedric-cordenier commented Jan 9, 2025 •
edited
Loading

Use the safeurl client to protect against SSRF vulnerabilities.

IPs and CIDR ranges can be explicitly blocked via the Gateway spec, but by default the safeurl.Client (as configured by this PR) blocks:

  • access to all ports except 443 and 80
  • access to all schemes except http/https
  • access to loopback, current (0.0.0.0) and RFC1918 IPs.

I tested the above using a local node

@cedric-cordenier cedric-cordenier marked this pull request as ready for review January 9, 2025 17:44
@cedric-cordenier cedric-cordenier requested review from a team as code owners January 9, 2025 17:44
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 9, 2025 •
edited
Loading

AER Report: CI Core ran successfully ✅

aer_workflow , commit

AER Report: Operator UI CI ran successfully ✅

aer_workflow , commit

@cedric-cordenier cedric-cordenier requested a review from a team as a code owner January 9, 2025 17:56
@cl-sonarqube-production
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@agparadiso agparadiso agparadiso approved these changes

@MStreet3 MStreet3 MStreet3 approved these changes

@ilija42 ilija42 Awaiting requested review from ilija42 ilija42 is a code owner automatically assigned from smartcontractkit/foundations

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@cedric-cordenier @MStreet3 @agparadiso