pezza_action_push_web 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb9c4ebdcbd17365efb10ed10e722ddc65e1313c46904a2fefcab41e2a77d7b3
-  data.tar.gz: b470819fb3149a2a9b48d98ccdfce99aafa86bf7f7f153eb0019c33b15a2e9ac
+  metadata.gz: 2b38a01863916f285ea98b99ea79483767c4633bc1bf51a54c232703260e947c
+  data.tar.gz: e0cad328df4292a41a013554ff90176b8fe34baaaf77477a03e26620ae7e0075
 SHA512:
-  metadata.gz: 3b550df8977bdd96661dd9cb96993697d409b0f6555a22e235429971b2e7cbd68a5800205526217b622a101774f1482b65fc60ef4a6ecd99467d8bc28cfb353b
-  data.tar.gz: 644ee1e71e8d4065e87fe9334078725b801ff3a9c2a7ea6f81de719e3e53ec139c4642c4d19852fbed0b798eb051854901a79f3f561189d2419971dd9b5eadef
+  metadata.gz: 1f8cc2f332367bfef4d89b06864379447337e09ae825354aa712de31c863d3b2b5ea90451cab640aca6756b4808bb013f9afe8572d258c3288b097b38d5e8418
+  data.tar.gz: 151514426c7a3218ada6b191a8fe917364d7a571577ec9d0b1174cb0d73e2b0cc3a91182dfabfa23934823879ab7d1a0dcdd409a1eb3b074b9ed85f1c7c108c5

data/README.md

@@ -93,8 +93,8 @@ shared:
     # Change the subject (default: mailto:sender@example.com).
     # expiration: mailto:support@my-domain.com
 
-    # Change the urgency (default: normal). You also choose to set this at the notification level.
-    # urgency: high
+    # Change the urgency (default: high). You also choose to set this at the notification level.
+    # urgency: normal
 ```
 
 This file contains the configuration for the push notification services you want to use.

data/app/controllers/action_push_web/subscriptions_controller.rb

@@ -1,11 +1,8 @@
 module ActionPushWeb
   class SubscriptionsController < ApplicationController
     def create
-      if subscription = ApplicationPushSubscription.find_by(push_subscription_params)
-        subscription.touch
-      else
-        ApplicationPushSubscription.create! push_subscription_params.merge(user_agent: request.user_agent)
-      end
+      ApplicationPushSubscription.create_with(user_agent: request.user_agent).
+        create_or_find_by!(push_subscription_params)
 
       head :ok
     end

data/app/models/action_push_web/ssrf_protection.rb

@@ -0,0 +1,52 @@
+module ActionPushWeb
+  module SsrfProtection
+    extend self
+
+    DNS_RESOLUTION_TIMEOUT = 2
+
+    DNS_NAMESERVERS = %w[
+      1.1.1.1
+      8.8.8.8
+    ]
+
+    DISALLOWED_IP_RANGES = [
+      IPAddr.new("0.0.0.0/8"),     # "This" network (RFC1700)
+      IPAddr.new("100.64.0.0/10"), # Carrier-grade NAT (RFC6598)
+      IPAddr.new("198.18.0.0/15")  # Benchmark testing (RFC2544)
+    ].freeze
+
+    def resolve_public_ip(hostname)
+      ip_addresses = resolve_dns(hostname)
+      public_ips = ip_addresses.reject { |ip| blocked_address?(ip) }
+      public_ips.sort_by { |ipaddr| ipaddr.ipv4? ? 0 : 1 }.first&.to_s
+    end
+
+    def blocked_address?(ip)
+      ip = IPAddr.new(ip.to_s) unless ip.is_a?(IPAddr)
+
+      ip.private? ||
+        ip.loopback? ||
+        ip.link_local? ||
+        ip.ipv4_mapped? ||
+        ip.ipv4_compat? ||
+        in_disallowed_range?(ip)
+    end
+
+    private
+      def resolve_dns(hostname)
+        ip_addresses = []
+
+        Resolv::DNS.open(nameserver: DNS_NAMESERVERS, timeouts: DNS_RESOLUTION_TIMEOUT) do |dns|
+          dns.each_address(hostname) do |ip_address|
+            ip_addresses << IPAddr.new(ip_address.to_s)
+          end
+        end
+
+        ip_addresses
+      end
+
+      def in_disallowed_range?(ip)
+        DISALLOWED_IP_RANGES.any? { |range| range.include?(ip) }
+      end
+  end
+end

data/app/models/action_push_web/subscription.rb

@@ -2,12 +2,53 @@ module ActionPushWeb
   class Subscription < ApplicationRecord
     include ActiveSupport::Rescuable
 
+    PERMITTED_ENDPOINT_HOSTS = %w[
+      jmt17.google.com
+      fcm.googleapis.com
+      updates.push.services.mozilla.com
+      web.push.apple.com
+      notify.windows.com
+    ].freeze
+
     rescue_from(TokenError) { destroy! }
 
     belongs_to :owner, polymorphic: true, optional: true
 
+    validates :endpoint, presence: true
+    validate :validate_endpoint_url
+
     def push(notification)
       ActionPushWeb.push(SubscriptionNotification.new(notification:, subscription: self))
     end
+
+    def resolved_endpoint_ip
+      return @resolved_endpoint_ip if defined?(@resolved_endpoint_ip)
+      @resolved_endpoint_ip = SsrfProtection.resolve_public_ip(endpoint_uri&.host)
+    end
+
+    private
+
+      def endpoint_uri
+        @endpoint_uri ||= URI.parse(endpoint) if endpoint.present?
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def validate_endpoint_url
+        if endpoint_uri.nil?
+          errors.add(:endpoint, "is not a valid URL")
+        elsif endpoint_uri.scheme != "https"
+          errors.add(:endpoint, "must use HTTPS")
+        elsif !permitted_endpoint_host?
+          errors.add(:endpoint, "is not a permitted push service")
+        elsif resolved_endpoint_ip.nil?
+          errors.add(:endpoint, "resolves to a private or invalid IP address")
+        end
+      end
+
+      def permitted_endpoint_host?
+        host = endpoint_uri&.host&.downcase
+        PERMITTED_ENDPOINT_HOSTS.any? { |permitted| host&.end_with?(permitted) }
+      end
   end
 end

data/db/migrate/20251209235643_add_unique_index.rb

@@ -0,0 +1,6 @@
+class AddUniqueIndex < ActiveRecord::Migration[8.1]
+  def change
+    add_index :action_push_web_subscriptions,
+      [ :owner_type, :owner_id, :endpoint ], unique: true
+  end
+end

data/db/migrate/20260517003340_add_unique_index_for_null_owner.rb

@@ -0,0 +1,6 @@
+class AddUniqueIndexForNullOwner < ActiveRecord::Migration[8.1]
+  def change
+    add_index :action_push_web_subscriptions, :endpoint, unique: true,
+      where: "owner_id IS NULL AND owner_type IS NULL"
+  end
+end

data/lib/action_push_web/notification.rb

@@ -46,7 +46,7 @@ module ActionPushWeb
     end
 
     def urgency
-      (@urgency.presence || config.fetch(:urgency, :normal)).to_s
+      (@urgency.presence || config.fetch(:urgency, :high)).to_s
     end
 
     def as_json

data/lib/action_push_web/pusher.rb

@@ -10,7 +10,11 @@ module ActionPushWeb
         it.body = payload
       end
 
-      connection.request(uri, request).tap { handle_response(it) }
+      if resolved_endpoint_ip
+        pinned_connection.request(request)
+      else
+        connection.request(uri, request)
+      end.tap { handle_response(it) }
     rescue OpenSSL::OpenSSLError
       raise TokenError.new
     end
@@ -20,7 +24,7 @@ module ActionPushWeb
     attr_reader :config, :notification
 
     delegate :title, :body, :icon_path, :path, :silent, :badge, :endpoint, :p256dh_key,
-      :auth_key, to: :notification
+      :auth_key, :resolved_endpoint_ip, to: :notification
 
     def message
       JSON.generate title:, options: { body:, icon: icon_path, silent:, badge:, data: { path: } }
@@ -38,6 +42,13 @@ module ActionPushWeb
       @uri ||= URI.parse(endpoint)
     end
 
+    def pinned_connection
+      Net::HTTP.new(uri.host, uri.port).tap do |http|
+        http.ipaddr = resolved_endpoint_ip
+        http.use_ssl = true
+      end
+    end
+
     def headers
       headers = {}
       headers["Content-Type"]     = "application/octet-stream"

data/lib/action_push_web/subscription_notification.rb

@@ -8,6 +8,6 @@ module ActionPushWeb
     attr_reader :notification, :subscription
 
     delegate_missing_to :notification
-    delegate :endpoint, :p256dh_key, :auth_key, to: :subscription
+    delegate :endpoint, :p256dh_key, :auth_key, :resolved_endpoint_ip, to: :subscription
   end
 end

data/lib/action_push_web/version.rb

@@ -1,3 +1,3 @@
 module ActionPushWeb
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/generators/action_push_web/install/templates/config/push.yml.tt

@@ -15,8 +15,8 @@ shared:
     # Change the subject (default: mailto:sender@example.com).
     # subject: mailto:support@my-domain.com
 
-    # Change the urgency (default: normal). You also choose to set this at the notification level.
-    # urgency: high
+    # Change the urgency (default: high). You also choose to set this at the notification level.
+    # urgency: normal
 
     # Change the icon path (default: nil). You also choose to set this at the notification level.
     # icon_path: https://example.com/icon.png

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pezza_action_push_web
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Nick Pezza
@@ -112,10 +112,13 @@ files:
 - app/controllers/action_push_web/subscriptions_controller.rb
 - app/helpers/action_push_web/application_helper.rb
 - app/jobs/action_push_web/notification_job.rb
+- app/models/action_push_web/ssrf_protection.rb
 - app/models/action_push_web/subscription.rb
 - config/importmap.rb
 - config/routes.rb
 - db/migrate/20250907213606_create_action_push_web_subscriptions.rb
+- db/migrate/20251209235643_add_unique_index.rb
+- db/migrate/20260517003340_add_unique_index_for_null_owner.rb
 - lib/action_push_web.rb
 - lib/action_push_web/engine.rb
 - lib/action_push_web/errors.rb
@@ -156,7 +159,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.1
+rubygems_version: 4.0.11
 specification_version: 4
 summary: Send push notifications to web apps
 test_files: []