-
Notifications
You must be signed in to change notification settings - Fork 100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Prevent SSRF #692
Prevent SSRF #692
Conversation
@shargon @vang1ong7ang Please check #694 |
if (entry.IsInternal()) | ||
return (OracleResponseCode.Forbidden, null); | ||
} | ||
goto download; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
would this result in infinite redirections?
infinite redirections will be stopped by the timeout
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Me can add a max-redirect
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Which timeout stops infinite redirections in the current implementation?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Which timeout stops infinite redirections in the current implementation?
It seems that no timeout will stop the infinite redirections now.
dns rebinding should be also considered |
* add invoked contract (#657) * add in file copyright (#679) * witness rule support (#676) * Prevent SSRF (#692) * limit free gas (#697) * add log when exception happens under debug mode (#690) * dbft: tune MaxBlock* parameters (#688) * Fix StateAPI.MakeFindStatesParams (#699) * update Console to ConsoleHelper (#682) * refac log (#700) * Make RpcServer.ProcessAsync public to enable better neo express integration (#701) * Limit result stack (#696) * fix MaxBlockSystemFee (#703) * code optimise (#704) * Add oracle global timeout (#698)
Fix #693