open_graph_fetcher 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46670fff3dd827c35482bd63b1c246aa876fd85f82b3fdff752144e4f07e537b
-  data.tar.gz: a260be55faeb2038d4aeacfa9d419a1b7301ec023d327eb51fc2d5a1992ff260
+  metadata.gz: 48a6853f8f4665764d603a012713c1e8a5cd44c9ad649efc7626b2e210bf0931
+  data.tar.gz: 53ef6ecb11ab043f4d905a659a834254169721d6018b3a7428f535ceaad635fe
 SHA512:
-  metadata.gz: f23ee76f381d04b9fcc1bb60eb2f1baf4a438647009987a072f7a23334008a18614f11bb9a9cf74065e5deb695f65a3d8bed786ea2e6f32137c61a4c14a4ae06
-  data.tar.gz: 005b86f83da1f16ce55998bcefc1bceb93c0e0137bccab08e72ad1da2e749077fe2a0f5e85cd0bbf6abc005181cb16c2abab01adc1e2fa623344146743d198a7
+  metadata.gz: aa81fcbfff70cb71a13c599ceaf4be687e97e38d2889424290fd0b6c7487c967575fae28864d47cc46988d164ed18894df257c2a6838a2c55e7d40d7b07c3318
+  data.tar.gz: 75e7edea3e478392eccfd6fdde4f25e8b33d711d539746f09dd63543a15faaaae1dd4fbb621348e3cd7ec4ad7d1a5042dd6b7a88cda35e118203e19adeb25460

data/README.md

@@ -3,10 +3,11 @@
 Fetch Open Graph metadata in a safer way.
 
 - Includes some mitigations for SSRF attacks
-- Blocks private and local IP ranges
+- Blocks the direct usage of IP addresses in URLs
+- Blocks private and local IP ranges (after DNS resolution)
 - Avoids TOC/TOU when connecting to the IP
 - Supports only HTTPS on the standard port (443)
-- Includes request timeouts
+- Includes request timeouts (for DNS and HTTP)
 - Avoids redirects
 - Allows only text/html responses
 - Returns only known OG properties and nothing else

data/examples/fetch.rb

@@ -0,0 +1,6 @@
+require 'open_graph_fetcher'
+
+url = "https://ogp.me"
+fetcher = OpenGraphFetcher::Fetcher.new(url)
+og_data = fetcher.fetch
+puts og_data

data/lib/open_graph_fetcher/errors.rb

@@ -1,8 +1,10 @@
 module OpenGraphFetcher
   class Error < StandardError; end
 
+  class InvalidURIError < Error; end
   class InvalidSchemeError < Error; end
   class InvalidPortError < Error; end
+  class InvalidHostError < Error; end
   class IPResolutionError < Error; end
   class PrivateIPError < Error; end
   class FetchError < Error; end

data/lib/open_graph_fetcher/fetcher.rb

@@ -5,8 +5,9 @@ require 'ipaddr'
 
 module OpenGraphFetcher
   class Fetcher
-    OG_PROPERTIES = %w[title type image url description].freeze
+    OG_PROPERTIES = %w[title type image url description site_name].freeze
     
+    DNS_TIMEOUT = 3
     OPEN_TIMEOUT = 3
     READ_TIMEOUT = 3
 
@@ -19,9 +20,10 @@ module OpenGraphFetcher
     end
 
     def fetch
-      uri = URI.parse(@url)
+      uri = parse_uri(@url)
       raise InvalidSchemeError, "Only HTTPS URLs are allowed" unless uri.scheme == "https"
-      raise InvalidPortError, "Only the default HTTPS port (443) is allowed" if uri.port && uri.port != 443
+      raise InvalidPortError, "Only the default HTTPS port (443) is allowed" unless uri.port == 443
+      raise InvalidHostError, "Using an IP as host is not allowed" if ip_address?(uri.hostname)
 
       ip_address = resolve_ip(uri)
       raise PrivateIPError, "Resolved IP address is in a private or reserved range" if private_ip?(ip_address)
@@ -34,12 +36,25 @@ module OpenGraphFetcher
     end
 
     private
+    
+    def parse_uri(url)
+      URI.parse(url)
+    rescue URI::InvalidURIError => e
+      raise InvalidURIError, "Could not parse URI: #{e.message}"
+    end
 
     def resolve_ip(uri)
-      Resolv.getaddress(uri.host)
+      Resolv::DNS.open do |dns|
+        dns.timeouts = DNS_TIMEOUT
+        dns.getaddress(uri.hostname).to_s
+      end
     rescue Resolv::ResolvError => e
       raise IPResolutionError, "Could not resolve IP: #{e.message}"
     end
+    
+    def ip_address?(host)
+      host =~ Resolv::IPv4::Regex || host =~ Resolv::IPv6::Regex
+    end
 
     def private_ip?(ip)
       ip_addr = IPAddr.new(ip)
@@ -48,9 +63,12 @@ module OpenGraphFetcher
 
     def fetch_data(uri, ip)
       request = Net::HTTP::Get.new(uri.request_uri)
-      Net::HTTP.start(uri.hostname, uri.port, ipaddr: ip, use_ssl: true, open_timeout: OPEN_TIMEOUT, read_timeout: READ_TIMEOUT) do |http|
-        http.request(request)
-      end
+      http = Net::HTTP.new(uri.hostname, 443)
+      http.ipaddr = ip
+      http.use_ssl = true
+      http.open_timeout = OPEN_TIMEOUT
+      http.read_timeout = READ_TIMEOUT
+      http.request(request)
     rescue Net::OpenTimeout, Net::ReadTimeout => e
       raise FetchError, "Request timed out: #{e.message}"
     rescue StandardError => e

data/lib/open_graph_fetcher/version.rb

@@ -1,3 +1,3 @@
 module OpenGraphFetcher
-  VERSION = '0.1.0'.freeze
+  VERSION = '0.3.0'.freeze
 end

data/spec/fetcher_spec.rb

@@ -4,7 +4,7 @@ require 'webmock/rspec'
 RSpec.describe OpenGraphFetcher::Fetcher do
 
   before do
-    allow(Resolv).to receive(:getaddress).and_return("203.0.113.0")
+    allow(Resolv::DNS).to receive(:open).and_return("203.0.113.0")
   end
 
   describe ".fetch" do
@@ -38,6 +38,28 @@ RSpec.describe OpenGraphFetcher::Fetcher do
           "description" => "Example description"
         })
       end
+      
+      it 'sets the ipaddr and other options on the Net::HTTP instance' do
+        http_instance = instance_double(Net::HTTP)
+        expect(Net::HTTP).to receive(:new).and_return(http_instance)
+
+        expect(http_instance).to receive(:ipaddr=).with("203.0.113.0")
+        expect(http_instance).to receive(:use_ssl=).with(true)
+        expect(http_instance).to receive(:open_timeout=).with(3)
+        expect(http_instance).to receive(:read_timeout=).with(3)
+
+        response_double = double("Net::HTTPResponse", code: "200", body: "<!DOCTYPE html><title>OK</title>")
+        expect(response_double).to receive(:[]).with("Content-Type").and_return("text/html")
+        expect(http_instance).to receive(:request).and_return(response_double)
+
+        OpenGraphFetcher::Fetcher.fetch("https://example.com")
+      end
+    end
+    
+    context "when given an invalid URL" do
+      it "raises an InvalidURIError" do
+        expect { OpenGraphFetcher::Fetcher.fetch("# test") }.to raise_error(OpenGraphFetcher::InvalidURIError)
+      end
     end
 
     context "when given an HTTP URL" do
@@ -51,20 +73,26 @@ RSpec.describe OpenGraphFetcher::Fetcher do
         expect { OpenGraphFetcher::Fetcher.fetch("https://example.com:8443") }.to raise_error(OpenGraphFetcher::InvalidPortError)
       end
     end
+    
+    context "when given a URL with an IP address" do
+      it "raises an InvalidHostError" do
+        expect { OpenGraphFetcher::Fetcher.fetch("https://203.0.113.0/test") }.to raise_error(OpenGraphFetcher::InvalidHostError)
+      end
+    end
 
     context "when the IP address cannot be resolved" do
       it "raises an IPResolutionError with an appropriate error message" do
-        allow(Resolv).to receive(:getaddress).and_raise(Resolv::ResolvError, "DNS resolution failed")
+        allow(Resolv::DNS).to receive(:open).and_raise(Resolv::ResolvError, "DNS resolution failed")
 
-        expect { OpenGraphFetcher::Fetcher.fetch("https://nonexistent-domain.com") }.to raise_error(OpenGraphFetcher::IPResolutionError, /Could not resolve IP: DNS resolution failed/)
+        expect { OpenGraphFetcher::Fetcher.fetch("https://nonexistent.example.com") }.to raise_error(OpenGraphFetcher::IPResolutionError, /Could not resolve IP: DNS resolution failed/)
       end
     end
 
     context "when the resolved IP address is private" do
       it "raises a PrivateIPError" do
-        allow(Resolv).to receive(:getaddress).with("10.0.0.1").and_return("10.0.0.1")
+        allow(Resolv::DNS).to receive(:open).and_return("10.0.0.1")
 
-        expect { OpenGraphFetcher::Fetcher.fetch("https://10.0.0.1") }.to raise_error(OpenGraphFetcher::PrivateIPError)
+        expect { OpenGraphFetcher::Fetcher.fetch("https://ssrf.example.com") }.to raise_error(OpenGraphFetcher::PrivateIPError)
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: open_graph_fetcher
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Marco Colli
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-04 00:00:00.000000000 Z
+date: 2024-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -52,8 +52,8 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
-email:
+description: 
+email: 
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -63,6 +63,7 @@ files:
 - Gemfile
 - LICENSE
 - README.md
+- examples/fetch.rb
 - lib/open_graph_fetcher.rb
 - lib/open_graph_fetcher/errors.rb
 - lib/open_graph_fetcher/fetcher.rb
@@ -73,7 +74,7 @@ homepage: https://github.com/collimarco/open_graph_fetcher
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -88,8 +89,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
-signing_key:
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: Fetch Open Graph metadata in a safer way.
 test_files: []