admin/CLICD
1
0
Fork 0
mirror of https://github.com/MengMengCode/CLICD.git synced 2026-08-05 05:36:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix something

Browse Source
This commit is contained in:
MengMengCode
2026-08-04 05:13:45 +08:00
parent 23a0541f7c
commit a736e156bb
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/safehttp/safehttp.go
+6 -3
View File
@@ -16,6 +16,7 @@ const maxRedirects = 10
var blockedDownloadPrefixes = []netip.Prefix{ var blockedDownloadPrefixes = []netip.Prefix{
netip.MustParsePrefix("0.0.0.0/8"), netip.MustParsePrefix("0.0.0.0/8"),
netip.MustParsePrefix("100.100.100.200/32"),
netip.MustParsePrefix("127.0.0.0/8"), netip.MustParsePrefix("127.0.0.0/8"),
netip.MustParsePrefix("169.254.0.0/16"), netip.MustParsePrefix("169.254.0.0/16"),
netip.MustParsePrefix("192.0.0.0/24"), netip.MustParsePrefix("192.0.0.0/24"),
@@ -36,6 +37,7 @@ var blockedDownloadPrefixes = []netip.Prefix{
netip.MustParsePrefix("2001:db8::/32"), netip.MustParsePrefix("2001:db8::/32"),
netip.MustParsePrefix("2001:20::/28"), netip.MustParsePrefix("2001:20::/28"),
netip.MustParsePrefix("2002::/16"), netip.MustParsePrefix("2002::/16"),
netip.MustParsePrefix("fd00:ec2::254/128"),
netip.MustParsePrefix("fec0::/10"), netip.MustParsePrefix("fec0::/10"),
netip.MustParsePrefix("fe80::/10"), netip.MustParsePrefix("fe80::/10"),
netip.MustParsePrefix("ff00::/8"), netip.MustParsePrefix("ff00::/8"),
@@ -114,9 +116,10 @@ func Get(ctx context.Context, rawURL, userAgent string, timeout time.Duration) (
}, },
} }
// All URL components, redirects, DNS answers and dial destinations are // The URL, redirects, DNS answers and dial destinations are constrained
// constrained above and in restrictedTransport. // above and in restrictedTransport. CodeQL cannot infer those checks across
// lgtm[go/request-forgery] // the custom transport boundary.
// codeql[go/request-forgery]
return client.Do(request) return client.Do(request)
} }
backend/internal/safehttp/safehttp_test.go
+4
View File
@@ -18,6 +18,8 @@ func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
"http://127.0.0.1/image", "http://127.0.0.1/image",
"http://[::1]/image", "http://[::1]/image",
"http://169.254.169.254/latest/meta-data", "http://169.254.169.254/latest/meta-data",
"http://100.100.100.200/latest/meta-data",
"http://[fd00:ec2::254]/latest/meta-data",
"http://example.com:99999/image", "http://example.com:99999/image",
} { } {
if _, err := ValidateURL(rawURL); err == nil { if _, err := ValidateURL(rawURL); err == nil {
@@ -64,12 +66,14 @@ func TestIsAllowedDownloadAddress(t *testing.T) {
"172.16.0.1": true, "172.16.0.1": true,
"192.168.1.1": true, "192.168.1.1": true,
"169.254.169.254": false, "169.254.169.254": false,
"100.100.100.200": false,
"192.0.2.1": false, "192.0.2.1": false,
"198.18.0.1": false, "198.18.0.1": false,
"::1": false, "::1": false,
"64:ff9b::127.0.0.1": false, "64:ff9b::127.0.0.1": false,
"2002:7f00:1::1": false, "2002:7f00:1::1": false,
"fc00::1": true, "fc00::1": true,
"fd00:ec2::254": false,
"fec0::1": false, "fec0::1": false,
"fe80::1": false, "fe80::1": false,
"2001:db8::1": false, "2001:db8::1": false,