ssrf_filter 1.4.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8044ad57435e5aa1af62c8defb3087ee7dce64fdfb9530b8d5d73a0793607f6e
-  data.tar.gz: 914546724fc94a99915d4c710c21e6ec89f24f5aa3b32cca8a2ec4613719a616
+  metadata.gz: '05509e34ae84e22f9e746604ec7717a095ea88a237c13dfabb2d840e24b38816'
+  data.tar.gz: 1c6694c52b643ec4992fd19c1822eb225c4e87d9cf75bd2b1b2654a5f06f9b10
 SHA512:
-  metadata.gz: 9b5842cc8b3a2b4bef7f82cd3956def19d1d96e7cb85c6524a36bffe4f04cfaf58a01630203d0ab824063507802c4a681503199accc3154e684b0f2bbd594b47
-  data.tar.gz: 494fff3091b5deb2aa76507a482114a55375322395f9e9fb4cf4139b1fabc5415d8ffa5a31497eb05217b70d8793960c4a808967536c64605f9787b776c07d92
+  metadata.gz: 352ca8aa91c7408f1b84d0791378e463da9e356feab9559209a05c43049879acf5f88445126fbb9532ce979a5ffed7960a057d9409399f5cba805cb062e19761
+  data.tar.gz: dbbdbb309c241adc37d81dc2f7a128834ce0bf04f0b87662121280aa37e81ddce6a39b2a206972fc63d72c492db81108ec67165bb7d3d5b8be45f1c46c579a55

data/lib/ssrf_filter/ssrf_filter.rb

@@ -59,13 +59,18 @@ class SsrfFilter
   NAT64_LOCAL_PREFIX = ::IPAddr.new('64:ff9b:1::/48').freeze
 
   IPV6_BLACKLIST = ([
+    ::IPAddr.new('::/128'), # Unspecified address
     ::IPAddr.new('::1/128'), # Loopback
     ::IPAddr.new('100::/64'), # Discard prefix (RFC 6666)
+    ::IPAddr.new('100:0:0:1::/64'), # Dummy IPv6 prefix (RFC 9780)
     ::IPAddr.new('2001::/32'), # Teredo tunneling
+    ::IPAddr.new('2001:2::/48'), # Benchmarking (RFC 5180)
     ::IPAddr.new('2001:10::/28'), # Deprecated (previously ORCHID)
     ::IPAddr.new('2001:20::/28'), # ORCHIDv2
     ::IPAddr.new('2001:db8::/32'), # Addresses used in documentation and example source code
     ::IPAddr.new('2002::/16'), # 6to4
+    ::IPAddr.new('3fff::/20'), # Documentation (RFC 9637)
+    ::IPAddr.new('5f00::/16'), # Segment Routing (SRv6) SIDs (RFC 9602)
     ::IPAddr.new('fc00::/7'), # Unique local address
     ::IPAddr.new('fe80::/10'), # Link-local address
     ::IPAddr.new('ff00::/8') # Multicast
@@ -91,6 +96,17 @@ class SsrfFilter
 
   DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS = false
   DEFAULT_MAX_REDIRECTS = 10
+  DEFAULT_SENSITIVE_HEADERS = %w[authorization cookie].freeze
+  DEFAULT_ON_CROSS_ORIGIN_REDIRECT = :strip
+
+  CONNECTION_ERRORS = [
+    ::Errno::EHOSTUNREACH,
+    ::Errno::ENETUNREACH,
+    ::Errno::EADDRNOTAVAIL,
+    ::Errno::ECONNREFUSED,
+    ::Errno::ETIMEDOUT,
+    ::Net::OpenTimeout
+  ].freeze
 
   VERB_MAP = {
     get: ::Net::HTTP::Get,
@@ -119,14 +135,19 @@ class SsrfFilter
   class CRLFInjection < Error
   end
 
+  class CredentialLeakage < Error
+  end
+
   VERB_MAP.each_key do |method|
     define_singleton_method(method) do |url, options = {}, &block|
+      url = url.to_s
       original_url = url
+      original_uri = URI(url)
       scheme_whitelist = options.fetch(:scheme_whitelist, DEFAULT_SCHEME_WHITELIST)
       resolver = options.fetch(:resolver, DEFAULT_RESOLVER)
       allow_unfollowed_redirects = options.fetch(:allow_unfollowed_redirects, DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS)
       max_redirects = options.fetch(:max_redirects, DEFAULT_MAX_REDIRECTS)
-      url = url.to_s
+      sensitive_headers = options.fetch(:sensitive_headers, DEFAULT_SENSITIVE_HEADERS)
 
       response = nil
       (max_redirects + 1).times do
@@ -143,7 +164,14 @@ class SsrfFilter
         public_addresses = ip_addresses.reject(&method(:unsafe_ip_address?))
         raise PrivateIPAddress, "Hostname '#{hostname}' has no public ip addresses" if public_addresses.empty?
 
-        response, url = fetch_once(uri, public_addresses.sample.to_s, method, options, &block)
+        headers_to_strip = if !sensitive_headers.empty? && different_origin?(original_uri, uri)
+          sensitive_headers
+        else
+          []
+        end
+
+        response, url = fetch_with_fallback(uri, public_addresses, method,
+          options.merge(headers_to_strip: headers_to_strip), &block)
         return response if url.nil?
       end
 
@@ -178,6 +206,10 @@ class SsrfFilter
     range.first != range.last
   end
 
+  private_class_method def self.different_origin?(uri1, uri2)
+    uri1.scheme != uri2.scheme || uri1.hostname != uri2.hostname || uri1.port != uri2.port
+  end
+
   private_class_method def self.normalized_hostname(uri)
     # Attach port for non-default as per RFC2616
     if (uri.port == 80 && uri.scheme == 'http') ||
@@ -188,6 +220,18 @@ class SsrfFilter
     end
   end
 
+  private_class_method def self.fetch_with_fallback(uri, public_addresses, verb, options, &block)
+    last_error = nil
+
+    public_addresses.shuffle.each do |ip_address|
+      return fetch_once(uri.dup, ip_address.to_s, verb, options, &block)
+    rescue *CONNECTION_ERRORS => e
+      last_error = e
+    end
+
+    raise last_error
+  end
+
   private_class_method def self.fetch_once(uri, ip, verb, options, &block)
     if options[:params]
       params = uri.query ? ::URI.decode_www_form(uri.query).to_h : {}
@@ -199,12 +243,30 @@ class SsrfFilter
     request['host'] = normalized_hostname(uri)
 
     Array(options[:headers]).each do |header, value|
+      # Newer rubies raise ArgumentError when assigning a header name with control characters, which
+      # would pre-empt the CRLFInjection check in validate_request, so reject it with our own error here
+      raise CRLFInjection, "CRLF injection in header #{header} with value #{value}" if header.to_s.count("\r\n") != 0
+
       request[header] = value
     end
 
     request.body = options[:body] if options[:body]
 
     options[:request_proc].call(request) if options[:request_proc].respond_to?(:call)
+
+    headers_to_strip = Array(options[:headers_to_strip])
+    unless headers_to_strip.empty?
+      if options[:on_cross_origin_redirect] == :raise
+        leaking = headers_to_strip.select { |h| request[h] }
+        unless leaking.empty?
+          raise CredentialLeakage,
+            "Cross-origin redirect would leak sensitive headers: #{leaking.join(', ')}"
+        end
+      else
+        headers_to_strip.each { |h| request.delete(h) }
+      end
+    end
+
     validate_request(request)
 
     http_options = (options[:http_options] || {}).merge(
@@ -212,7 +274,7 @@ class SsrfFilter
       ipaddr: ip
     )
 
-    ::Net::HTTP.start(uri.hostname, uri.port, **http_options) do |http|
+    ::Net::HTTP.start(uri.hostname, uri.port, nil, **http_options) do |http|
       response = http.request(request) do |res|
         block&.call(res)
       end

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.4.0'
+  VERSION = '1.6.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-31 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -181,7 +181,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.3.7
 signing_key:
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks