Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent SSRF #692

Merged
merged 8 commits into from
Mar 9, 2022
Merged

Prevent SSRF #692

Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7b661e5
add log when exception happens under debug mode (#686)
Jim8y Feb 8, 2022
32aacc4
Revert "add log when exception happens under debug mode (#686)" (#689)
superboyiii Feb 8, 2022
20784b8
Prevent SSRF
shargon Feb 26, 2022
9653b8b
Merge branch 'develop' into fix-ssrf
shargon Mar 3, 2022
e536fe9
Update OracleHttpsProtocol.cs
shargon Mar 3, 2022
e6d7191
remove goto
shargon Mar 4, 2022
55c0dd6
Remove redundant code
erikzhang Mar 9, 2022
cfe5bb9
Remove empty line
erikzhang Mar 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions src/OracleService/Protocols/OracleHttpsProtocol.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ namespace Neo.Plugins
{
class OracleHttpsProtocol : IOracleProtocol
{
private readonly HttpClient client = new HttpClient();
private readonly HttpClient client = new(new HttpClientHandler() { AllowAutoRedirect = false });

public OracleHttpsProtocol()
{
Expand Down Expand Up @@ -40,15 +40,28 @@ public void Dispose()

if (!Settings.Default.AllowPrivateHost)
{
IPHostEntry entry = await Dns.GetHostEntryAsync(uri.Host);
IPHostEntry entry = await Dns.GetHostEntryAsync(uri.Host, cancellation);
if (entry.IsInternal())
return (OracleResponseCode.Forbidden, null);
}

HttpResponseMessage message;
try
{
erikzhang marked this conversation as resolved.
Show resolved Hide resolved
download:
message = await client.GetAsync(uri, HttpCompletionOption.ResponseContentRead, cancellation);
if (message.StatusCode == HttpStatusCode.NotFound && message.Headers.Location is not null)
shargon marked this conversation as resolved.
Show resolved Hide resolved
{
uri = message.Headers.Location;
if (!Settings.Default.AllowPrivateHost)
{
// Follow
IPHostEntry entry = await Dns.GetHostEntryAsync(uri.Host, cancellation);
if (entry.IsInternal())
return (OracleResponseCode.Forbidden, null);
}
goto download;
Copy link

@vang1ong7ang vang1ong7ang Mar 2, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would this result in infinite redirections?

infinite redirections will be stopped by the timeout

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Me can add a max-redirect

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which timeout stops infinite redirections in the current implementation?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which timeout stops infinite redirections in the current implementation?

It seems that no timeout will stop the infinite redirections now.

}
}
catch
{
Expand Down