faraday-ssrf-filter 0.4.1 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +4 -0
- data/lib/faraday/ssrf_filter/middleware.rb +9 -1
- data/lib/faraday/ssrf_filter/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d5c8260d03d6e9ab5097368246fe9ce6c7bf7447bb1913fae62e128a6cf64f9b
|
|
4
|
+
data.tar.gz: 4f8027b67738ff69fd6a6e54ba1ecf4aa9a8bd82b17f9e8b9e864abfb03adf66
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 1e980dc512d023b12deb63cd27ab3314289b026261d0f7a20a62652255cc30641f6872d36d509758e443488727c6af263c1a4efeed78e03a87ee32c6de1cb9f8
|
|
7
|
+
data.tar.gz: eee110d9f7f3e4962a0f875e92e795727a31f3f80872caec5eef6db790cfd1a2f540cc4e2dacdada0c69bc51985f570cf244be9fd77787f43962e97b73e15bdd
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.4.2 (2026-10-24)
|
|
4
|
+
|
|
5
|
+
- Fix a 0.4.1 regression: a same-host relative redirect over HTTP dropped the pinned `Host` header, because the relative `Location` resolves against the URL already rewritten to the pinned IP
|
|
6
|
+
|
|
3
7
|
## 0.4.1 (2026-10-24)
|
|
4
8
|
|
|
5
9
|
- Drop the `Host` header pinned for a previous HTTP hop when a redirect goes to a direct IP address too (it was only dropped for hostname targets)
|
|
@@ -117,7 +117,7 @@ module Faraday
|
|
|
117
117
|
|
|
118
118
|
if addr
|
|
119
119
|
validate_direct_ip!(addr, hostname)
|
|
120
|
-
unpin_previous_host!(env[:request_headers]) if env[:request_headers]
|
|
120
|
+
unpin_previous_host!(env[:request_headers]) if pinned_to_other_ip?(env[:request_headers], addr)
|
|
121
121
|
else
|
|
122
122
|
resolve_and_pin!(env, hostname)
|
|
123
123
|
end
|
|
@@ -167,6 +167,14 @@ module Faraday
|
|
|
167
167
|
PINNED_HOST_HEADERS.each { |header| headers.delete(header) }
|
|
168
168
|
end
|
|
169
169
|
|
|
170
|
+
# A relative redirect resolves against the URL already rewritten to the
|
|
171
|
+
# pinned IP, so a hop to that same IP is still the original host.
|
|
172
|
+
def pinned_to_other_ip?(headers, addr)
|
|
173
|
+
return false unless headers
|
|
174
|
+
|
|
175
|
+
parse_ip(headers['X-Faraday-SSRF-Resolved-IP'].to_s) != addr
|
|
176
|
+
end
|
|
177
|
+
|
|
170
178
|
def validate_redirect!(env)
|
|
171
179
|
return unless REDIRECT_STATUSES.cover?(env[:status])
|
|
172
180
|
|