Cover download SSRF guard: DNS rebinding and address-range edge cases #29

New issue

Open

opened 2026-10-18 16:23:38 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 16:23:38 +00:00

Owner

Non-blocking follow-ups from Nye's approval of #19 (fixes #6).

DNS rebinding: the address is checked, then Req resolves again to connect. Pin the connection to the checked IP (connect to the address, send Host/SNI for the name).
IPv4-compatible IPv6: public_address? treats ::a.b.c.d (::/96, e.g. ::7f00:1) as public. Add {0,0,0,0,0,0,_,_} to the blocked set.
Over-block: a == 192 and b == 0 blocks all of 192.0.0.0/16; only 192.0.0.0/24 and 192.0.2.0/24 are special. Harmless, tighten if convenient.

Non-blocking follow-ups from Nye's approval of #19 (fixes #6). - **DNS rebinding:** the address is checked, then Req resolves again to connect. Pin the connection to the checked IP (connect to the address, send Host/SNI for the name). - **IPv4-compatible IPv6:** `public_address?` treats `::a.b.c.d` (`::/96`, e.g. `::7f00:1`) as public. Add `{0,0,0,0,0,0,_,_}` to the blocked set. - **Over-block:** `a == 192 and b == 0` blocks all of 192.0.0.0/16; only 192.0.0.0/24 and 192.0.2.0/24 are special. Harmless, tighten if convenient.

jfro added the

main

security

low

labels

2026-10-18 16:23:38 +00:00