ssrf_filter 1.0.6 → 1.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 2e7c6b603a075892984767c0e84bdc31acef8a94
-  data.tar.gz: ad328c0f06c37ab4ce7f33610e5f6b16ee0a3537
+SHA256:
+  metadata.gz: 17984597a9ad2c3dd852793334951478090086e5c6b7f86d67cf827fa98bff4c
+  data.tar.gz: 99c09e926f2b2c3a040dd0deed245ebb005f6cb242a185a7bca15592183f0b82
 SHA512:
-  metadata.gz: 553c787de96785842f54c22f4ca9ae85b417ce38139ee93daa95deea1f0ca39383150bc242099d63fa4cea9161508cc4f58e27e06bcc5958bca1d58e7fed1744
-  data.tar.gz: f010ffafa1cdf23f45426f33b37eda10df5ad4ac27bef1e4d79851728c2ce3a24e52b62cb8b2c03a11400a0b7db29329672d6be101562d03152df3f0a1641eb5
+  metadata.gz: ad60b8c2efaca1de0b7d89de0102eef87d23c65d1c6b73e674092e7740e8c5fe1a006801c648529bf9150eb590df9b3c160af519b666176f41697ef69218918e
+  data.tar.gz: '062843311bfdb75b9de842fb29e4864da4a4acc4c41d454fec593ee3c0a86f306cddd30d4cc9c46b6d6b169b2e3e3480c2e8499cb637eaf97d96afa534b41569'

data/lib/ssrf_filter/patch/ssl_socket.rb

@@ -27,6 +27,7 @@ class SsrfFilter
 
       def self.apply!
         return if instance_variable_defined?(:@patched_ssl_socket)
+
         @patched_ssl_socket = true
 
         ::OpenSSL::SSL::SSLSocket.class_eval do

data/lib/ssrf_filter/ssrf_filter.rb

@@ -53,11 +53,12 @@ class SsrfFilter
     ::IPAddr.new('2002::/16'), # 6to4
     ::IPAddr.new('fc00::/7'), # Unique local address
     ::IPAddr.new('fe80::/10'), # Link-local address
-    ::IPAddr.new('ff00::/8'), # Multicast
+    ::IPAddr.new('ff00::/8') # Multicast
   ] + IPV4_BLACKLIST.flat_map do |ipaddr|
     prefixlen = prefixlen_from_ipaddr(ipaddr)
 
-    ipv4_compatible = ipaddr.ipv4_compat.mask(96 + prefixlen)
+    # Don't call ipaddr.ipv4_compat because it prints out a deprecation warning on ruby 2.5+
+    ipv4_compatible = IPAddr.new(ipaddr.to_i, Socket::AF_INET6).mask(96 + prefixlen)
     ipv4_mapped = ipaddr.ipv4_mapped.mask(80 + prefixlen)
 
     [ipv4_compatible, ipv4_mapped]
@@ -188,9 +189,11 @@ class SsrfFilter
     block.call(request) if block_given?
     validate_request(request)
 
-    use_ssl = uri.scheme == 'https'
+    http_options = options[:http_options] || {}
+    http_options[:use_ssl] = (uri.scheme == 'https')
+
     with_forced_hostname(hostname) do
-      ::Net::HTTP.start(uri.hostname, uri.port, use_ssl: use_ssl) do |http|
+      ::Net::HTTP.start(uri.hostname, uri.port, http_options) do |http|
         http.request(request)
       end
     end

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.0.6'.freeze
+  VERSION = '1.0.7'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.0.7
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-25 00:00:00.000000000 Z
+date: 2019-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -16,70 +16,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.6.0
+        version: 0.6.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.6.0
+        version: 0.6.1
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.0
+        version: 0.8.22
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.0
+        version: 0.8.22
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.7.0
+        version: 3.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.7.0
+        version: 3.8.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.3.0
+        version: 3.5.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.3.0
+        version: 3.5.1
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.52.0
+        version: 0.65.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.52.0
+        version: 0.65.0
 description: A gem that makes it easy to prevent server side request forgery (SSRF)
   attacks
 email: 
@@ -111,8 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks