ssrf_filter 1.0.8 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ad08c7683abaf9c1cce31358e91eebd54e2276911da99c3d7bdbc1481ec6a8f
-  data.tar.gz: 4993290726f69399264c18dfe8b4ef1c908b78c726f0cfb5dcbc5b9c09043ead
+  metadata.gz: '05509e34ae84e22f9e746604ec7717a095ea88a237c13dfabb2d840e24b38816'
+  data.tar.gz: 1c6694c52b643ec4992fd19c1822eb225c4e87d9cf75bd2b1b2654a5f06f9b10
 SHA512:
-  metadata.gz: 522368253a813feb3ac735f419b8d9fe6ac3b006debf3e3c003f6909d809b5b51af06ccc9c42b7cd8d18e90d54a298d3a39fee0514304a1c3a2a1ffd1d54580d
-  data.tar.gz: 21cd1fe841b77536db7e51e9cddc94b7ed96305bf766bb16df77e5b83029a6b6c44e042d1036ae52a135419e72ae70ec1155c471fdc6596eb9dab07809e54e36
+  metadata.gz: 352ca8aa91c7408f1b84d0791378e463da9e356feab9559209a05c43049879acf5f88445126fbb9532ce979a5ffed7960a057d9409399f5cba805cb062e19761
+  data.tar.gz: dbbdbb309c241adc37d81dc2f7a128834ce0bf04f0b87662121280aa37e81ddce6a39b2a206972fc63d72c492db81108ec67165bb7d3d5b8be45f1c46c579a55

data/lib/ssrf_filter/ssrf_filter.rb

@@ -6,11 +6,13 @@ require 'resolv'
 require 'uri'
 
 class SsrfFilter
-  def self.prefixlen_from_ipaddr(ipaddr)
+  private_class_method def self.prefixlen_from_ipaddr(ipaddr)
     mask_addr = ipaddr.instance_variable_get('@mask_addr')
     raise ArgumentError, 'Invalid mask' if mask_addr.zero?
 
-    mask_addr >>= 1 while (mask_addr & 0x1).zero?
+    while mask_addr.nobits?(0x1)
+      mask_addr >>= 1
+    end
 
     length = 0
     while mask_addr & 0x1 == 0x1
@@ -20,7 +22,19 @@ class SsrfFilter
 
     length
   end
-  private_class_method :prefixlen_from_ipaddr
+
+  private_class_method def self.ipv4_from_rfc6052(ipv6_addr, prefix_len)
+    n = ipv6_addr.to_i
+    ipv4_int = case prefix_len
+    when 32 then (n >> 64) & 0xFFFF_FFFF
+    when 40 then (((n >> 64) & 0xFFFFFF) << 8)  | ((n >> 48) & 0xFF)
+    when 48 then (((n >> 64) & 0xFFFF)   << 16) | ((n >> 40) & 0xFFFF)
+    when 56 then (((n >> 64) & 0xFF)     << 24) | ((n >> 32) & 0xFFFFFF)
+    when 64 then (n >> 24) & 0xFFFF_FFFF
+    when 96 then n & 0xFFFF_FFFF
+    end
+    ::IPAddr.new(ipv4_int, Socket::AF_INET) if ipv4_int
+  end
 
   # https://en.wikipedia.org/wiki/Reserved_IP_addresses
   IPV4_BLACKLIST = [
@@ -32,7 +46,6 @@ class SsrfFilter
     ::IPAddr.new('172.16.0.0/12'), # Private network
     ::IPAddr.new('192.0.0.0/24'), # IETF Protocol Assignments
     ::IPAddr.new('192.0.2.0/24'), # TEST-NET-1, documentation and examples
-    ::IPAddr.new('192.88.99.0/24'), # IPv6 to IPv4 relay (includes 2002::/16)
     ::IPAddr.new('192.168.0.0/16'), # Private network
     ::IPAddr.new('198.18.0.0/15'), # Network benchmark tests
     ::IPAddr.new('198.51.100.0/24'), # TEST-NET-2, documentation and examples
@@ -42,15 +55,22 @@ class SsrfFilter
     ::IPAddr.new('255.255.255.255') # Broadcast
   ].freeze
 
+  # NAT64 local-use prefix (RFC 8215), uses RFC 6052 /48 encoding (checked at runtime).
+  NAT64_LOCAL_PREFIX = ::IPAddr.new('64:ff9b:1::/48').freeze
+
   IPV6_BLACKLIST = ([
+    ::IPAddr.new('::/128'), # Unspecified address
     ::IPAddr.new('::1/128'), # Loopback
-    ::IPAddr.new('64:ff9b::/96'), # IPv4/IPv6 translation (RFC 6052)
     ::IPAddr.new('100::/64'), # Discard prefix (RFC 6666)
+    ::IPAddr.new('100:0:0:1::/64'), # Dummy IPv6 prefix (RFC 9780)
     ::IPAddr.new('2001::/32'), # Teredo tunneling
+    ::IPAddr.new('2001:2::/48'), # Benchmarking (RFC 5180)
     ::IPAddr.new('2001:10::/28'), # Deprecated (previously ORCHID)
     ::IPAddr.new('2001:20::/28'), # ORCHIDv2
     ::IPAddr.new('2001:db8::/32'), # Addresses used in documentation and example source code
     ::IPAddr.new('2002::/16'), # 6to4
+    ::IPAddr.new('3fff::/20'), # Documentation (RFC 9637)
+    ::IPAddr.new('5f00::/16'), # Segment Routing (SRv6) SIDs (RFC 9602)
     ::IPAddr.new('fc00::/7'), # Unique local address
     ::IPAddr.new('fe80::/10'), # Link-local address
     ::IPAddr.new('ff00::/8') # Multicast
@@ -58,10 +78,14 @@ class SsrfFilter
     prefixlen = prefixlen_from_ipaddr(ipaddr)
 
     # Don't call ipaddr.ipv4_compat because it prints out a deprecation warning on ruby 2.5+
-    ipv4_compatible = IPAddr.new(ipaddr.to_i, Socket::AF_INET6).mask(96 + prefixlen)
-    ipv4_mapped = ipaddr.ipv4_mapped.mask(80 + prefixlen)
-
-    [ipv4_compatible, ipv4_mapped]
+    ipv4_compatible  = IPAddr.new(ipaddr.to_i, Socket::AF_INET6).mask(96 + prefixlen)
+    ipv4_mapped      = ipaddr.ipv4_mapped.mask(80 + prefixlen)
+    # IPv4-translated (RFC 2765): ::ffff:0:x.x.x.x/96+n
+    ipv4_translated  = IPAddr.new("::ffff:0:#{ipaddr}").mask(96 + prefixlen)
+    # NAT64 well-known prefix (RFC 6052): 64:ff9b::x.x.x.x/96+n
+    nat64_well_known = IPAddr.new("64:ff9b::#{ipaddr}").mask(96 + prefixlen)
+
+    [ipv4_compatible, ipv4_mapped, ipv4_translated, nat64_well_known]
   end).freeze
 
   DEFAULT_SCHEME_WHITELIST = %w[http https].freeze
@@ -70,7 +94,19 @@ class SsrfFilter
     ::Resolv.getaddresses(hostname).map { |ip| ::IPAddr.new(ip) }
   end
 
+  DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS = false
   DEFAULT_MAX_REDIRECTS = 10
+  DEFAULT_SENSITIVE_HEADERS = %w[authorization cookie].freeze
+  DEFAULT_ON_CROSS_ORIGIN_REDIRECT = :strip
+
+  CONNECTION_ERRORS = [
+    ::Errno::EHOSTUNREACH,
+    ::Errno::ENETUNREACH,
+    ::Errno::EADDRNOTAVAIL,
+    ::Errno::ECONNREFUSED,
+    ::Errno::ETIMEDOUT,
+    ::Net::OpenTimeout
+  ].freeze
 
   VERB_MAP = {
     get: ::Net::HTTP::Get,
@@ -81,8 +117,6 @@ class SsrfFilter
     patch: ::Net::HTTP::Patch
   }.freeze
 
-  FIBER_LOCAL_KEY = :__ssrf_filter_hostname
-
   class Error < ::StandardError
   end
 
@@ -101,17 +135,21 @@ class SsrfFilter
   class CRLFInjection < Error
   end
 
-  %i[get put post delete head patch].each do |method|
-    define_singleton_method(method) do |url, options = {}, &block|
-      ::SsrfFilter::Patch::SSLSocket.apply!
-      ::SsrfFilter::Patch::HTTPGenericRequest.apply!
+  class CredentialLeakage < Error
+  end
 
-      original_url = url
-      scheme_whitelist = options[:scheme_whitelist] || DEFAULT_SCHEME_WHITELIST
-      resolver = options[:resolver] || DEFAULT_RESOLVER
-      max_redirects = options[:max_redirects] || DEFAULT_MAX_REDIRECTS
+  VERB_MAP.each_key do |method|
+    define_singleton_method(method) do |url, options = {}, &block|
       url = url.to_s
-
+      original_url = url
+      original_uri = URI(url)
+      scheme_whitelist = options.fetch(:scheme_whitelist, DEFAULT_SCHEME_WHITELIST)
+      resolver = options.fetch(:resolver, DEFAULT_RESOLVER)
+      allow_unfollowed_redirects = options.fetch(:allow_unfollowed_redirects, DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS)
+      max_redirects = options.fetch(:max_redirects, DEFAULT_MAX_REDIRECTS)
+      sensitive_headers = options.fetch(:sensitive_headers, DEFAULT_SENSITIVE_HEADERS)
+
+      response = nil
       (max_redirects + 1).times do
         uri = URI(url)
 
@@ -126,83 +164,133 @@ class SsrfFilter
         public_addresses = ip_addresses.reject(&method(:unsafe_ip_address?))
         raise PrivateIPAddress, "Hostname '#{hostname}' has no public ip addresses" if public_addresses.empty?
 
-        response = fetch_once(uri, public_addresses.sample.to_s, method, options, &block)
-
-        case response
-        when ::Net::HTTPRedirection then
-          url = response['location']
-          # Handle relative redirects
-          url = "#{uri.scheme}://#{hostname}:#{uri.port}#{url}" if url.start_with?('/')
+        headers_to_strip = if !sensitive_headers.empty? && different_origin?(original_uri, uri)
+          sensitive_headers
         else
-          return response
+          []
         end
+
+        response, url = fetch_with_fallback(uri, public_addresses, method,
+          options.merge(headers_to_strip: headers_to_strip), &block)
+        return response if url.nil?
       end
 
+      return response if allow_unfollowed_redirects
+
       raise TooManyRedirects, "Got #{max_redirects} redirects fetching #{original_url}"
     end
   end
 
-  def self.unsafe_ip_address?(ip_address)
+  private_class_method def self.unsafe_ip_address?(ip_address)
     return true if ipaddr_has_mask?(ip_address)
 
     return IPV4_BLACKLIST.any? { |range| range.include?(ip_address) } if ip_address.ipv4?
-    return IPV6_BLACKLIST.any? { |range| range.include?(ip_address) } if ip_address.ipv6?
+
+    if ip_address.ipv6?
+      return true if IPV6_BLACKLIST.any? { |range| range.include?(ip_address) }
+
+      # RFC 6052 /48 encoding for NAT64 local-use prefix (RFC 8215): 64:ff9b:1::/48
+      # IPv4 is split around u-bits at positions 64-71, so must be decoded at runtime
+      if NAT64_LOCAL_PREFIX.dup.include?(ip_address)
+        ipv4 = ipv4_from_rfc6052(ip_address, 48)
+        return unsafe_ip_address?(ipv4)
+      end
+      return false
+    end
 
     true
   end
-  private_class_method :unsafe_ip_address?
 
-  def self.ipaddr_has_mask?(ipaddr)
+  private_class_method def self.ipaddr_has_mask?(ipaddr)
     range = ipaddr.to_range
     range.first != range.last
   end
-  private_class_method :ipaddr_has_mask?
 
-  def self.host_header(hostname, uri)
+  private_class_method def self.different_origin?(uri1, uri2)
+    uri1.scheme != uri2.scheme || uri1.hostname != uri2.hostname || uri1.port != uri2.port
+  end
+
+  private_class_method def self.normalized_hostname(uri)
     # Attach port for non-default as per RFC2616
     if (uri.port == 80 && uri.scheme == 'http') ||
        (uri.port == 443 && uri.scheme == 'https')
-      hostname
+      uri.hostname
     else
-      "#{hostname}:#{uri.port}"
+      "#{uri.hostname}:#{uri.port}"
+    end
+  end
+
+  private_class_method def self.fetch_with_fallback(uri, public_addresses, verb, options, &block)
+    last_error = nil
+
+    public_addresses.shuffle.each do |ip_address|
+      return fetch_once(uri.dup, ip_address.to_s, verb, options, &block)
+    rescue *CONNECTION_ERRORS => e
+      last_error = e
     end
+
+    raise last_error
   end
-  private_class_method :host_header
 
-  def self.fetch_once(uri, ip, verb, options, &block)
+  private_class_method def self.fetch_once(uri, ip, verb, options, &block)
     if options[:params]
-      params = uri.query ? ::Hash[::URI.decode_www_form(uri.query)] : {}
+      params = uri.query ? ::URI.decode_www_form(uri.query).to_h : {}
       params.merge!(options[:params])
       uri.query = ::URI.encode_www_form(params)
     end
 
-    hostname = uri.hostname
-    uri.hostname = ip
-
     request = VERB_MAP[verb].new(uri)
-    request['host'] = host_header(hostname, uri)
+    request['host'] = normalized_hostname(uri)
 
     Array(options[:headers]).each do |header, value|
+      # Newer rubies raise ArgumentError when assigning a header name with control characters, which
+      # would pre-empt the CRLFInjection check in validate_request, so reject it with our own error here
+      raise CRLFInjection, "CRLF injection in header #{header} with value #{value}" if header.to_s.count("\r\n") != 0
+
       request[header] = value
     end
 
     request.body = options[:body] if options[:body]
 
-    block.call(request) if block_given?
+    options[:request_proc].call(request) if options[:request_proc].respond_to?(:call)
+
+    headers_to_strip = Array(options[:headers_to_strip])
+    unless headers_to_strip.empty?
+      if options[:on_cross_origin_redirect] == :raise
+        leaking = headers_to_strip.select { |h| request[h] }
+        unless leaking.empty?
+          raise CredentialLeakage,
+            "Cross-origin redirect would leak sensitive headers: #{leaking.join(', ')}"
+        end
+      else
+        headers_to_strip.each { |h| request.delete(h) }
+      end
+    end
+
     validate_request(request)
 
-    http_options = options[:http_options] || {}
-    http_options[:use_ssl] = (uri.scheme == 'https')
+    http_options = (options[:http_options] || {}).merge(
+      use_ssl: uri.scheme == 'https',
+      ipaddr: ip
+    )
 
-    with_forced_hostname(hostname) do
-      ::Net::HTTP.start(uri.hostname, uri.port, http_options) do |http|
-        http.request(request)
+    ::Net::HTTP.start(uri.hostname, uri.port, nil, **http_options) do |http|
+      response = http.request(request) do |res|
+        block&.call(res)
+      end
+      case response
+      when ::Net::HTTPRedirection
+        url = response['location']
+        # Handle relative redirects
+        url = "#{uri.scheme}://#{normalized_hostname(uri)}#{url}" if url&.start_with?('/')
+      else
+        url = nil
       end
+      return response, url
     end
   end
-  private_class_method :fetch_once
 
-  def self.validate_request(request)
+  private_class_method def self.validate_request(request)
     # RFC822 allows multiline "folded" headers:
     # https://tools.ietf.org/html/rfc822#section-3.1
     # In practice if any user input is ever supplied as a header key/value, they'll get
@@ -213,13 +301,4 @@ class SsrfFilter
       end
     end
   end
-  private_class_method :validate_request
-
-  def self.with_forced_hostname(hostname, &_block)
-    ::Thread.current[FIBER_LOCAL_KEY] = hostname
-    yield
-  ensure
-    ::Thread.current[FIBER_LOCAL_KEY] = nil
-  end
-  private_class_method :with_forced_hostname
 end

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.0.8'.freeze
+  VERSION = '1.6.0'
 end

data/lib/ssrf_filter.rb

@@ -1,6 +1,4 @@
 # frozen_string_literal: true
 
-require 'ssrf_filter/patch/http_generic_request'
-require 'ssrf_filter/patch/ssl_socket'
 require 'ssrf_filter/ssrf_filter'
 require 'ssrf_filter/version'

metadata

@@ -1,141 +1,155 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.0.8
+  version: 1.6.0
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-08-04 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.6.1
+        version: 0.9.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.6.1
+        version: 0.9.2
 - !ruby/object:Gem::Dependency
-  name: coveralls
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.22
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.8.22
+        version: 3.13.0
 - !ruby/object:Gem::Dependency
-  name: psych
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '4'
+        version: 1.68.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '4'
+        version: 1.68.0
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.8.0
+        version: 3.2.0
 - !ruby/object:Gem::Dependency
-  name: webmock
+  name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.1
+        version: 0.22.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.5.1
+        version: 0.22.0
 - !ruby/object:Gem::Dependency
-  name: webrick
+  name: simplecov-lcov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
-  name: public_suffix
+  name: tsort
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.5
+        version: 0.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.5
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
-  name: rexml
+  name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.24.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.24.0
 - !ruby/object:Gem::Dependency
-  name: rubocop
+  name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.50.0
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.50.0
+        version: '0'
 description: A gem that makes it easy to prevent server side request forgery (SSRF)
   attacks
 email:
@@ -144,14 +158,14 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/ssrf_filter.rb
-- lib/ssrf_filter/patch/http_generic_request.rb
-- lib/ssrf_filter/patch/ssl_socket.rb
 - lib/ssrf_filter/ssrf_filter.rb
 - lib/ssrf_filter/version.rb
 homepage: https://github.com/arkadiyt/ssrf_filter
 licenses:
 - MIT
-metadata: {}
+metadata:
+  changelog_uri: https://github.com/arkadiyt/ssrf_filter/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -160,14 +174,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.0.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.15
+rubygems_version: 3.3.7
 signing_key:
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks

data/lib/ssrf_filter/patch/http_generic_request.rb

@@ -1,83 +0,0 @@
-require 'stringio'
-
-class SsrfFilter
-  module Patch
-    module HTTPGenericRequest
-      # Ruby had a bug in its Http library where if you set a custom `Host` header on a request it would get
-      # overwritten. This was tracked in:
-      # https://bugs.ruby-lang.org/issues/10054
-      # and resolved with the commit:
-      # https://github.com/ruby/ruby/commit/70a2eb63999265ff7e8d46d1f5b410c8ee3d30d7#diff-5c08b4ae27d2294a8294a27ff9af4a85
-      # Versions of Ruby that don't have this fix applied will fail to connect to certain hosts via SsrfFilter. The
-      # patch below backports the fix from the linked commit.
-
-      def self.should_apply?
-        # Check if the patch needs to be applied:
-        # The Ruby bug was that HTTPGenericRequest#exec overwrote the Host header, so this snippet checks
-        # if we can reproduce that behavior. It does not actually open any network connections.
-
-        uri = URI('https://www.example.com')
-        request = ::Net::HTTPGenericRequest.new('HEAD', false, false, uri)
-        request['host'] = '127.0.0.1'
-        request.exec(StringIO.new, '1.1', '/')
-        request['host'] == uri.hostname
-      end
-
-      # Apply the patch from the linked commit onto ::Net::HTTPGenericRequest. Since this is 3rd party code,
-      # disable code coverage and rubocop linting for this section.
-      # :nocov:
-      # rubocop:disable all
-      def self.apply!
-        return if instance_variable_defined?(:@checked_http_generic_request)
-        @checked_http_generic_request = true
-        return unless should_apply?
-
-        ::Net::HTTPGenericRequest.class_eval do
-          def exec(sock, ver, path)
-            if @body
-              send_request_with_body sock, ver, path, @body
-            elsif @body_stream
-              send_request_with_body_stream sock, ver, path, @body_stream
-            elsif @body_data
-              send_request_with_body_data sock, ver, path, @body_data
-            else
-              write_header sock, ver, path
-            end
-          end
-
-          def update_uri(addr, port, ssl)
-            # reflect the connection and @path to @uri
-            return unless @uri
-
-            if ssl
-              scheme = 'https'.freeze
-              klass = URI::HTTPS
-            else
-              scheme = 'http'.freeze
-              klass = URI::HTTP
-            end
-
-            if host = self['host']
-              host.sub!(/:.*/s, ''.freeze)
-            elsif host = @uri.host
-            else
-             host = addr
-            end
-            # convert the class of the URI
-            if @uri.is_a?(klass)
-              @uri.host = host
-              @uri.port = port
-            else
-              @uri = klass.new(
-                scheme, @uri.userinfo,
-                host, port, nil,
-                @uri.path, nil, @uri.query, nil)
-            end
-          end
-        end
-      end
-      # rubocop:enable all
-      # :nocov:
-    end
-  end
-end

data/lib/ssrf_filter/patch/ssl_socket.rb

@@ -1,49 +0,0 @@
-class SsrfFilter
-  module Patch
-    module SSLSocket
-      # When fetching a url we'd like to have the following workflow:
-      # 1) resolve the hostname www.example.com, and choose a public ip address to connect to
-      # 2) connect to that specific ip address, to prevent things like DNS TOCTTOU bugs or other trickery
-      #
-      # Ideally this would happen by the ruby http library giving us control over DNS resolution,
-      # but it doesn't. Instead, when making the request we set the uri.hostname to the chosen ip address,
-      # and send a 'Host' header of the original hostname, i.e. connect to 'http://93.184.216.34/' and send
-      # a 'Host: www.example.com' header.
-      #
-      # This works for the http case, http://www.example.com. For the https case, this causes certificate
-      # validation failures, since the server certificate for https://www.example.com will not have a
-      # Subject Alternate Name for 93.184.216.34.
-      #
-      # Thus we perform the monkey-patch below, modifying SSLSocket's `post_connection_check(hostname)`
-      # and `hostname=(hostname)` methods:
-      # If our fiber local variable is set, use that for the hostname instead, otherwise behave as usual.
-      # The only time the variable will be set is if you are executing inside a `with_forced_hostname` block,
-      # which is used in ssrf_filter.rb.
-      #
-      # An alternative approach could be to pass in our own OpenSSL::X509::Store with a custom
-      # `verify_callback` to the ::Net::HTTP.start call, but this would require reimplementing certification
-      # validation, which is dangerous. This way we can piggyback on the existing validation and simply pretend
-      # that we connected to the desired hostname.
-
-      def self.apply!
-        return if instance_variable_defined?(:@patched_ssl_socket)
-
-        @patched_ssl_socket = true
-
-        ::OpenSSL::SSL::SSLSocket.class_eval do
-          original_post_connection_check = instance_method(:post_connection_check)
-          define_method(:post_connection_check) do |hostname|
-            original_post_connection_check.bind(self).call(::Thread.current[::SsrfFilter::FIBER_LOCAL_KEY] || hostname)
-          end
-
-          if method_defined?(:hostname=)
-            original_hostname = instance_method(:hostname=)
-            define_method(:hostname=) do |hostname|
-              original_hostname.bind(self).call(::Thread.current[::SsrfFilter::FIBER_LOCAL_KEY] || hostname)
-            end
-          end
-        end
-      end
-    end
-  end
-end