ssrf_filter 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8044ad57435e5aa1af62c8defb3087ee7dce64fdfb9530b8d5d73a0793607f6e
-  data.tar.gz: 914546724fc94a99915d4c710c21e6ec89f24f5aa3b32cca8a2ec4613719a616
+  metadata.gz: d68f597eb7885a7c9941fc8f134f7a6b87eec03fc0c92b6b6684a00d1be00069
+  data.tar.gz: 2c934e958e0542c2ae1606b0657cb2096d54647969f291aa41579fd3f0363c67
 SHA512:
-  metadata.gz: 9b5842cc8b3a2b4bef7f82cd3956def19d1d96e7cb85c6524a36bffe4f04cfaf58a01630203d0ab824063507802c4a681503199accc3154e684b0f2bbd594b47
-  data.tar.gz: 494fff3091b5deb2aa76507a482114a55375322395f9e9fb4cf4139b1fabc5415d8ffa5a31497eb05217b70d8793960c4a808967536c64605f9787b776c07d92
+  metadata.gz: 231e5f001e5540067710bc8894364592707fde79adafcbed2d4ea019646eb4b71fe60fae76caa562e8161090cffcb49390521045f57d153d8569eeeeaef85e79
+  data.tar.gz: 6854c8b312de12da5ea27bf842533eb48719ed98668d83838b4e07c1408ccacb302cfa7830b23c810e27d8f46e0f95cfcabd9919c29c86b351b8f285dac25934

data/lib/ssrf_filter/ssrf_filter.rb

@@ -91,6 +91,8 @@ class SsrfFilter
 
   DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS = false
   DEFAULT_MAX_REDIRECTS = 10
+  DEFAULT_SENSITIVE_HEADERS = %w[authorization cookie].freeze
+  DEFAULT_ON_CROSS_ORIGIN_REDIRECT = :strip
 
   VERB_MAP = {
     get: ::Net::HTTP::Get,
@@ -119,14 +121,19 @@ class SsrfFilter
   class CRLFInjection < Error
   end
 
+  class CredentialLeakage < Error
+  end
+
   VERB_MAP.each_key do |method|
     define_singleton_method(method) do |url, options = {}, &block|
+      url = url.to_s
       original_url = url
+      original_uri = URI(url)
       scheme_whitelist = options.fetch(:scheme_whitelist, DEFAULT_SCHEME_WHITELIST)
       resolver = options.fetch(:resolver, DEFAULT_RESOLVER)
       allow_unfollowed_redirects = options.fetch(:allow_unfollowed_redirects, DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS)
       max_redirects = options.fetch(:max_redirects, DEFAULT_MAX_REDIRECTS)
-      url = url.to_s
+      sensitive_headers = options.fetch(:sensitive_headers, DEFAULT_SENSITIVE_HEADERS)
 
       response = nil
       (max_redirects + 1).times do
@@ -143,7 +150,14 @@ class SsrfFilter
         public_addresses = ip_addresses.reject(&method(:unsafe_ip_address?))
         raise PrivateIPAddress, "Hostname '#{hostname}' has no public ip addresses" if public_addresses.empty?
 
-        response, url = fetch_once(uri, public_addresses.sample.to_s, method, options, &block)
+        headers_to_strip = if !sensitive_headers.empty? && different_origin?(original_uri, uri)
+          sensitive_headers
+        else
+          []
+        end
+
+        response, url = fetch_once(uri, public_addresses.sample.to_s, method,
+          options.merge(headers_to_strip: headers_to_strip), &block)
         return response if url.nil?
       end
 
@@ -178,6 +192,10 @@ class SsrfFilter
     range.first != range.last
   end
 
+  private_class_method def self.different_origin?(uri1, uri2)
+    uri1.scheme != uri2.scheme || uri1.hostname != uri2.hostname || uri1.port != uri2.port
+  end
+
   private_class_method def self.normalized_hostname(uri)
     # Attach port for non-default as per RFC2616
     if (uri.port == 80 && uri.scheme == 'http') ||
@@ -205,6 +223,20 @@ class SsrfFilter
     request.body = options[:body] if options[:body]
 
     options[:request_proc].call(request) if options[:request_proc].respond_to?(:call)
+
+    headers_to_strip = Array(options[:headers_to_strip])
+    unless headers_to_strip.empty?
+      if options[:on_cross_origin_redirect] == :raise
+        leaking = headers_to_strip.select { |h| request[h] }
+        unless leaking.empty?
+          raise CredentialLeakage,
+            "Cross-origin redirect would leak sensitive headers: #{leaking.join(', ')}"
+        end
+      else
+        headers_to_strip.each { |h| request.delete(h) }
+      end
+    end
+
     validate_request(request)
 
     http_options = (options[:http_options] || {}).merge(

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.4.0'
+  VERSION = '1.5.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-31 00:00:00.000000000 Z
+date: 2026-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64