ssrf_filter 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 68db49bb250c05d11655c0afe1913b34247d783c
-  data.tar.gz: f1d11ee2913e121b3c996a1af745926a3da953e2
+  metadata.gz: 855ec5e3486aa13ddfebb55690b3e7d30f6148d2
+  data.tar.gz: 6df3da50c9087158e4cb2911a290ba694406e111
 SHA512:
-  metadata.gz: 201bf113012c32ddb97e79df1fe9428d9dff43be894d340789a6b937f819e4538e680f8ec66e0d458a396ed7e082d1d20374d4b8c0fc0833970fb6b1d9a81bad
-  data.tar.gz: 769532a2d3f68fe97a20a001d73fc930855dbdd7c1dbe4ac115c29e2f7661f509c3d89cbe21480a7630e503af7bb3bea7b4fedbb625fb2e51e5a08aa4a1a1dc4
+  metadata.gz: ac67704b7c90ba7c2b7a43b94e1d2a7f9230776f5754e195cc74076abe1a0e90c2cfa05b43fe5d8d7da40359729e7df056f15f6c00b16763e37c8f8e5e6d30a9
+  data.tar.gz: 0f0f93dc6016603c49d151006c70564f9eb9dfc60ddbe4cd28b537f091ae4ba0b4830739987e70d9deaff307a18a2c0f5f89a19c5cb6ca10188c1b1002728b5a

data/lib/ssrf_filter/ssrf_filter.rb

@@ -4,6 +4,22 @@ require 'resolv'
 require 'uri'
 
 class SsrfFilter
+  def self.prefixlen_from_ipaddr(ipaddr)
+    mask_addr = ipaddr.instance_variable_get('@mask_addr')
+    raise ArgumentError, 'Invalid mask' if mask_addr.zero?
+
+    mask_addr >>= 1 while (mask_addr & 0x1).zero?
+
+    length = 0
+    while mask_addr & 0x1 == 0x1
+      length += 1
+      mask_addr >>= 1
+    end
+
+    length
+  end
+  private_class_method :prefixlen_from_ipaddr
+
   # https://en.wikipedia.org/wiki/Reserved_IP_addresses
   IPV4_BLACKLIST = [
     ::IPAddr.new('0.0.0.0/8'), # Current network (only valid as source address)
@@ -24,7 +40,7 @@ class SsrfFilter
     ::IPAddr.new('255.255.255.255') # Broadcast
   ].freeze
 
-  IPV6_BLACKLIST = [
+  IPV6_BLACKLIST = ([
     ::IPAddr.new('::1/128'), # Loopback
     ::IPAddr.new('64:ff9b::/96'), # IPv4/IPv6 translation (RFC 6052)
     ::IPAddr.new('100::/64'), # Discard prefix (RFC 6666)
@@ -36,7 +52,14 @@ class SsrfFilter
     ::IPAddr.new('fc00::/7'), # Unique local address
     ::IPAddr.new('fe80::/10'), # Link-local address
     ::IPAddr.new('ff00::/8'), # Multicast
-  ].freeze
+  ] + IPV4_BLACKLIST.flat_map do |ipaddr|
+    prefixlen = prefixlen_from_ipaddr(ipaddr)
+
+    ipv4_compatible = ipaddr.ipv4_compat.mask(96 + prefixlen)
+    ipv4_mapped = ipaddr.ipv4_mapped.mask(80 + prefixlen)
+
+    [ipv4_compatible, ipv4_mapped]
+  end).freeze
 
   DEFAULT_SCHEME_WHITELIST = %w[http https].freeze
 
@@ -110,14 +133,7 @@ class SsrfFilter
     return true if ipaddr_has_mask?(ip_address)
 
     return IPV4_BLACKLIST.any? { |range| range.include?(ip_address) } if ip_address.ipv4?
-
-    if ip_address.ipv6?
-      result = IPV6_BLACKLIST.any? { |range| range.include?(ip_address) }
-      # TODO: convert these to be members of IPV6_BLACKLIST
-      result ||= ip_address.ipv4_compat? && IPV4_BLACKLIST.any? { |range| range.include?(ip_address.ipv4_compat) }
-      result ||= ip_address.ipv4_mapped? && IPV4_BLACKLIST.any? { |range| range.include?(ip_address.ipv4_mapped) }
-      return result
-    end
+    return IPV6_BLACKLIST.any? { |range| range.include?(ip_address) } if ip_address.ipv6?
 
     true
   end
@@ -140,7 +156,8 @@ class SsrfFilter
     uri.hostname = ip
 
     request = VERB_MAP[verb].new(uri)
-    request['host'] = hostname
+    # Attach port for non-80 as per RFC2616
+    request['host'] = uri.port == 80 ? hostname : "#{hostname}:#{uri.port}"
 
     Array(options[:headers]).each do |header, value|
       request[header] = value

data/lib/ssrf_filter/version.rb

@@ -1,3 +1,3 @@
 class SsrfFilter
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.0.1'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-25 00:00:00.000000000 Z
+date: 2017-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.8'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -110,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 2.6.12
 signing_key: 
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks