ssrf_filter 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d68f597eb7885a7c9941fc8f134f7a6b87eec03fc0c92b6b6684a00d1be00069
-  data.tar.gz: 2c934e958e0542c2ae1606b0657cb2096d54647969f291aa41579fd3f0363c67
+  metadata.gz: '05509e34ae84e22f9e746604ec7717a095ea88a237c13dfabb2d840e24b38816'
+  data.tar.gz: 1c6694c52b643ec4992fd19c1822eb225c4e87d9cf75bd2b1b2654a5f06f9b10
 SHA512:
-  metadata.gz: 231e5f001e5540067710bc8894364592707fde79adafcbed2d4ea019646eb4b71fe60fae76caa562e8161090cffcb49390521045f57d153d8569eeeeaef85e79
-  data.tar.gz: 6854c8b312de12da5ea27bf842533eb48719ed98668d83838b4e07c1408ccacb302cfa7830b23c810e27d8f46e0f95cfcabd9919c29c86b351b8f285dac25934
+  metadata.gz: 352ca8aa91c7408f1b84d0791378e463da9e356feab9559209a05c43049879acf5f88445126fbb9532ce979a5ffed7960a057d9409399f5cba805cb062e19761
+  data.tar.gz: dbbdbb309c241adc37d81dc2f7a128834ce0bf04f0b87662121280aa37e81ddce6a39b2a206972fc63d72c492db81108ec67165bb7d3d5b8be45f1c46c579a55

data/lib/ssrf_filter/ssrf_filter.rb

@@ -59,13 +59,18 @@ class SsrfFilter
   NAT64_LOCAL_PREFIX = ::IPAddr.new('64:ff9b:1::/48').freeze
 
   IPV6_BLACKLIST = ([
+    ::IPAddr.new('::/128'), # Unspecified address
     ::IPAddr.new('::1/128'), # Loopback
     ::IPAddr.new('100::/64'), # Discard prefix (RFC 6666)
+    ::IPAddr.new('100:0:0:1::/64'), # Dummy IPv6 prefix (RFC 9780)
     ::IPAddr.new('2001::/32'), # Teredo tunneling
+    ::IPAddr.new('2001:2::/48'), # Benchmarking (RFC 5180)
     ::IPAddr.new('2001:10::/28'), # Deprecated (previously ORCHID)
     ::IPAddr.new('2001:20::/28'), # ORCHIDv2
     ::IPAddr.new('2001:db8::/32'), # Addresses used in documentation and example source code
     ::IPAddr.new('2002::/16'), # 6to4
+    ::IPAddr.new('3fff::/20'), # Documentation (RFC 9637)
+    ::IPAddr.new('5f00::/16'), # Segment Routing (SRv6) SIDs (RFC 9602)
     ::IPAddr.new('fc00::/7'), # Unique local address
     ::IPAddr.new('fe80::/10'), # Link-local address
     ::IPAddr.new('ff00::/8') # Multicast
@@ -94,6 +99,15 @@ class SsrfFilter
   DEFAULT_SENSITIVE_HEADERS = %w[authorization cookie].freeze
   DEFAULT_ON_CROSS_ORIGIN_REDIRECT = :strip
 
+  CONNECTION_ERRORS = [
+    ::Errno::EHOSTUNREACH,
+    ::Errno::ENETUNREACH,
+    ::Errno::EADDRNOTAVAIL,
+    ::Errno::ECONNREFUSED,
+    ::Errno::ETIMEDOUT,
+    ::Net::OpenTimeout
+  ].freeze
+
   VERB_MAP = {
     get: ::Net::HTTP::Get,
     put: ::Net::HTTP::Put,
@@ -156,7 +170,7 @@ class SsrfFilter
           []
         end
 
-        response, url = fetch_once(uri, public_addresses.sample.to_s, method,
+        response, url = fetch_with_fallback(uri, public_addresses, method,
           options.merge(headers_to_strip: headers_to_strip), &block)
         return response if url.nil?
       end
@@ -206,6 +220,18 @@ class SsrfFilter
     end
   end
 
+  private_class_method def self.fetch_with_fallback(uri, public_addresses, verb, options, &block)
+    last_error = nil
+
+    public_addresses.shuffle.each do |ip_address|
+      return fetch_once(uri.dup, ip_address.to_s, verb, options, &block)
+    rescue *CONNECTION_ERRORS => e
+      last_error = e
+    end
+
+    raise last_error
+  end
+
   private_class_method def self.fetch_once(uri, ip, verb, options, &block)
     if options[:params]
       params = uri.query ? ::URI.decode_www_form(uri.query).to_h : {}
@@ -217,6 +243,10 @@ class SsrfFilter
     request['host'] = normalized_hostname(uri)
 
     Array(options[:headers]).each do |header, value|
+      # Newer rubies raise ArgumentError when assigning a header name with control characters, which
+      # would pre-empt the CRLFInjection check in validate_request, so reject it with our own error here
+      raise CRLFInjection, "CRLF injection in header #{header} with value #{value}" if header.to_s.count("\r\n") != 0
+
       request[header] = value
     end
 
@@ -244,7 +274,7 @@ class SsrfFilter
       ipaddr: ip
     )
 
-    ::Net::HTTP.start(uri.hostname, uri.port, **http_options) do |http|
+    ::Net::HTTP.start(uri.hostname, uri.port, nil, **http_options) do |http|
       response = http.request(request) do |res|
         block&.call(res)
       end

data/lib/ssrf_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class SsrfFilter
-  VERSION = '1.5.0'
+  VERSION = '1.6.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-03 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -181,7 +181,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.3.7
 signing_key:
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks