ssrf_filter 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97b1c63593031040d2f23b6fbb055c44490fc2624a5b9901203053c971991ba6
-  data.tar.gz: ca816401abe0177feea5fd70d01afd19758598cd9864659a8eb97e7184367830
+  metadata.gz: f0230e20c7cd24b24dad277ee01042f3a4885fa68a8ea593fe0607de92023026
+  data.tar.gz: 6ce71a83907b1acfc382acc5d859a26fc1471dc3cd2dbc48d14b3e1dfca12051
 SHA512:
-  metadata.gz: 75ae3f265b486cb8768ef0c49d3dd0313a218b3863a2c1dfc8615727453aea45ab7ae5f71289e3748eecb9e17dc09443870413937c7fbad56a9a7a225b2fbb89
-  data.tar.gz: c881ea003dafd105bbbff4001646a879fc4cefb18d722fc60f21281c8ebaca8b19a324dccadb9acdf799e56501905addebcfe8f91253ee52136a9dab433335ad
+  metadata.gz: cb56468fb4bdcf10168efbc18f004d996363b9dcc8877a1fab1eff508ef1519b86c7eeb750fedd8b565a162804746f9a036b54e584520137c1c2b1a86d5c9421
+  data.tar.gz: 9d5e0ea62956d551caa2474a384fa90e827c6d133bbfe04831f77dd49cabe5bcb3abc7008eefc63bccedf1634a33bcc27f8178253ec26f7e051075dcfba7066e

data/lib/ssrf_filter/patch/resolv.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'resolv'
+
+class SsrfFilter
+  module Patch
+    module Resolv
+      # As described in ssl_socket.rb, we want to patch ruby's http connection code to allow us to make outbound network
+      # requests while ensuring that both:
+      # 1) we're connecting to a public / non-private ip address
+      # 2) https connections continue to work
+      #
+      # This used to work fine prior to this change in ruby's net/http library:
+      # https://github.com/ruby/net-http/pull/36
+      # After this changed was introduced our patch no longer works - we need to set the hostname to the correct
+      # value on the SSLSocket (`s.hostname = ssl_host_address`), but that code path no longer executes due to the
+      # modification in the linked pull request.
+      #
+      # To work around this we introduce the patch below, which forces our ip address string to not match against the
+      # Resolv IPv4/IPv6 regular expressions. This is ugly and cumbersome but I didn't see any better path.
+      class PatchedRegexp < Regexp
+        def ===(other)
+          if ::Thread.current.key?(::SsrfFilter::FIBER_ADDRESS_KEY) &&
+             other.object_id.equal?(::Thread.current[::SsrfFilter::FIBER_ADDRESS_KEY].object_id)
+            false
+          else
+            super(other)
+          end
+        end
+      end
+
+      def self.apply!
+        return if instance_variable_defined?(:@patched_resolv)
+
+        @patched_resolv = true
+
+        old_ipv4 = ::Resolv::IPv4.send(:remove_const, :Regex)
+        old_ipv6 = ::Resolv::IPv6.send(:remove_const, :Regex)
+        ::Resolv::IPv4.const_set(:Regex, PatchedRegexp.new(old_ipv4))
+        ::Resolv::IPv6.const_set(:Regex, PatchedRegexp.new(old_ipv6))
+      end
+    end
+  end
+end

data/lib/ssrf_filter/patch/ssl_socket.rb

@@ -35,13 +35,14 @@ class SsrfFilter
         ::OpenSSL::SSL::SSLSocket.class_eval do
           original_post_connection_check = instance_method(:post_connection_check)
           define_method(:post_connection_check) do |hostname|
-            original_post_connection_check.bind(self).call(::Thread.current[::SsrfFilter::FIBER_LOCAL_KEY] || hostname)
+            original_post_connection_check.bind(self).call(::Thread.current[::SsrfFilter::FIBER_HOSTNAME_KEY] ||
+              hostname)
           end
 
           if method_defined?(:hostname=)
             original_hostname = instance_method(:hostname=)
             define_method(:hostname=) do |hostname|
-              original_hostname.bind(self).call(::Thread.current[::SsrfFilter::FIBER_LOCAL_KEY] || hostname)
+              original_hostname.bind(self).call(::Thread.current[::SsrfFilter::FIBER_HOSTNAME_KEY] || hostname)
             end
           end
         end

data/lib/ssrf_filter/ssrf_filter.rb

@@ -83,7 +83,8 @@ class SsrfFilter
     patch: ::Net::HTTP::Patch
   }.freeze
 
-  FIBER_LOCAL_KEY = :__ssrf_filter_hostname
+  FIBER_HOSTNAME_KEY = :__ssrf_filter_hostname
+  FIBER_ADDRESS_KEY = :__ssrf_filter_address
 
   class Error < ::StandardError
   end
@@ -106,6 +107,7 @@ class SsrfFilter
   %i[get put post delete head patch].each do |method|
     define_singleton_method(method) do |url, options = {}, &block|
       ::SsrfFilter::Patch::SSLSocket.apply!
+      ::SsrfFilter::Patch::Resolv.apply!
 
       original_url = url
       scheme_whitelist = options[:scheme_whitelist] || DEFAULT_SCHEME_WHITELIST
@@ -187,7 +189,7 @@ class SsrfFilter
     http_options = options[:http_options] || {}
     http_options[:use_ssl] = (uri.scheme == 'https')
 
-    with_forced_hostname(hostname) do
+    with_forced_hostname(hostname, ip) do
       ::Net::HTTP.start(uri.hostname, uri.port, **http_options) do |http|
         http.request(request) do |response|
           case response
@@ -219,11 +221,13 @@ class SsrfFilter
   end
   private_class_method :validate_request
 
-  def self.with_forced_hostname(hostname, &_block)
-    ::Thread.current[FIBER_LOCAL_KEY] = hostname
+  def self.with_forced_hostname(hostname, ip, &_block)
+    ::Thread.current[FIBER_HOSTNAME_KEY] = hostname
+    ::Thread.current[FIBER_ADDRESS_KEY] = ip
     yield
   ensure
-    ::Thread.current[FIBER_LOCAL_KEY] = nil
+    ::Thread.current[FIBER_HOSTNAME_KEY] = nil
+    ::Thread.current[FIBER_ADDRESS_KEY] = nil
   end
   private_class_method :with_forced_hostname
 end

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 end

data/lib/ssrf_filter.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'ssrf_filter/patch/resolv'
 require 'ssrf_filter/patch/ssl_socket'
 require 'ssrf_filter/ssrf_filter'
 require 'ssrf_filter/version'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-08-28 00:00:00.000000000 Z
+date: 2022-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -144,6 +144,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/ssrf_filter.rb
+- lib/ssrf_filter/patch/resolv.rb
 - lib/ssrf_filter/patch/ssl_socket.rb
 - lib/ssrf_filter/ssrf_filter.rb
 - lib/ssrf_filter/version.rb