veilrender 0.6.2__tar.gz → 0.6.3__tar.gz

{veilrender-0.6.2 → veilrender-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veilrender
-Version: 0.6.2
+Version: 0.6.3
 Summary: Headless browser rendering API — self-hostable on HF Spaces, Docker, or bare metal
 Author: Peng Ding
 License-Expression: MIT

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/__init__.py

@@ -1,3 +1,3 @@
 """VeilRender — headless browser rendering API."""
 
-__version__ = "0.6.2"
+__version__ = "0.6.3"

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/browser.py

@@ -789,12 +789,15 @@ class BrowserManager:
         self._health_task: asyncio.Task | None = None  # type: ignore[type-arg]
         self._queue_depth: int = 0
 
-        if settings.resource_filter:
-            self._blocklist = load_blocklist(settings.blocked_domains_extra)
-            self._route_handler = make_route_handler(self._blocklist)
-        else:
-            self._blocklist = frozenset()
-            self._route_handler = None
+        self._blocklist = (
+            load_blocklist(settings.blocked_domains_extra)
+            if settings.resource_filter
+            else frozenset()
+        )
+        # The route handler enforces both ad/tracker filtering and the SSRF
+        # destination guard, so it is always installed: an empty blocklist
+        # disables filtering only, never the security check.
+        self._route_handler = make_route_handler(self._blocklist)
 
     async def start(self) -> None:
         for w in self._workers:

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/filters.py

@@ -9,12 +9,15 @@ https://github.com/StevenBlack/hosts
 
 from __future__ import annotations
 
+import asyncio
 import importlib.resources
 import logging
 from urllib.parse import urlparse
 
 from patchright.async_api import Route
 
+from veilrender.url_validator import is_global_host
+
 logger = logging.getLogger(__name__)
 
 
@@ -81,7 +84,19 @@ def should_block(url: str, blocklist: frozenset[str]) -> bool:
 
 
 def make_route_handler(blocklist: frozenset[str]):
-    """Create a Playwright route handler that blocks requests to listed domains.
+    """Create a Playwright route handler enforcing the outbound request policy.
+
+    Two checks run on every request the browser issues, including requests
+    produced by a redirect or by a subresource fetch:
+
+    1. The blocklist (ad/tracker domains) is matched by domain suffix.
+    2. The destination host must resolve only to globally routable addresses,
+       so a redirect cannot bounce the navigation into loopback, RFC1918, the
+       cloud metadata endpoint, or any other non-public range.
+
+    Checking the destination rather than the URL the caller submitted is what
+    closes the redirect-based SSRF: the submitted URL passes validation, but
+    the hop it redirects to does not.
 
     Args:
         blocklist: Set of blocked domain names.
@@ -90,12 +105,56 @@ def make_route_handler(blocklist: frozenset[str]):
         An async route handler function for use with ``page.route()``.
     """
 
+    # Hostnames already found to be non-public stay blocked for the life of the
+    # handler. Only refusals are cached: caching an allow would let a host that
+    # later resolves to a private address slip through.
+    blocked_hosts: set[str] = set()
+
     async def _handle_route(route: Route) -> None:
         url = route.request.url
+
         if should_block(url, blocklist):
-            logger.info("Blocked: %s", url[:200])
+            logger.info("Blocked (blocklist): %s", url[:200])
+            await route.abort("blockedbyclient")
+            return
+
+        if not await _allows_public_destination(url, blocked_hosts):
+            logger.warning("Blocked (non-public destination): %s", url[:200])
             await route.abort("blockedbyclient")
-        else:
-            await route.continue_()
+            return
+
+        await route.continue_()
 
     return _handle_route
+
+
+async def _allows_public_destination(url: str, blocked_hosts: set[str]) -> bool:
+    """Check that a request URL points at a globally routable host.
+
+    Non-network schemes (``data:``, ``blob:``, ``about:``) carry inline
+    content rather than triggering a fetch, so they are allowed through. DNS
+    resolution blocks, so it runs in a worker thread to avoid stalling the
+    event loop.
+
+    Args:
+        url: The request URL the browser is about to issue.
+        blocked_hosts: Cache of hostnames already known to be non-public.
+            Refusals are recorded here.
+
+    Returns:
+        True if the request may proceed.
+    """
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        return True
+
+    hostname = (parsed.hostname or "").lower()
+    if not hostname:
+        return False
+    if hostname in blocked_hosts:
+        return False
+
+    allowed = await asyncio.to_thread(is_global_host, hostname)
+    if not allowed:
+        blocked_hosts.add(hostname)
+    return allowed

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/routes/render.py

@@ -194,6 +194,13 @@ def register(app: App) -> None:
                     {"error": "URL triggers a file download, not a renderable page"},
                     status_code=400,
                 )
+            if "blockedbyclient" in exc_str or "ERR_BLOCKED_BY_CLIENT" in exc_str:
+                stats.render.record_failure(elapsed)
+                logger.warning("Navigation blocked by outbound policy for %s", req.url)
+                return JSONResponse(
+                    {"error": "Destination blocked by outbound request policy"},
+                    status_code=400,
+                )
             stats.render.record_failure(elapsed)
             logger.error("Render failed for %s: %s", req.url, exc)
             return JSONResponse(
@@ -201,6 +208,20 @@ def register(app: App) -> None:
                 status_code=502,
             )
 
+        # Re-check where the navigation actually ended up. The submitted URL is
+        # validated up front, but a redirect can land somewhere else entirely,
+        # and the body returned below comes from wherever it landed.
+        try:
+            validate_url(final_url)
+        except URLValidationError as exc:
+            elapsed = (time.monotonic() - t0) * 1000
+            stats.render.record_failure(elapsed)
+            logger.warning("Rejected redirect destination %s: %s", final_url, exc)
+            return JSONResponse(
+                {"error": f"Redirect destination rejected: {exc!s}"},
+                status_code=400,
+            )
+
         # Build content based on requested formats
         content = RenderContent()
 

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/routes/screenshot.py

@@ -102,6 +102,10 @@ def register(app: App) -> None:
                     wait_until=effective_wu,
                     timeout=goto_timeout,
                 )
+                # A redirect can land somewhere other than the submitted URL,
+                # so re-check where navigation actually ended up before
+                # capturing anything from it.
+                validate_url(page.url)
                 # Font CSS is cached locally as inline content — single
                 # add_style_tag(content=...) call, no external network.
                 # Skip on full_page where content > typography.
@@ -209,8 +213,26 @@ def register(app: App) -> None:
                 status_code=504,
                 content_type="application/json",
             )
+        except URLValidationError as exc:
+            elapsed = (time.monotonic() - t0) * 1000
+            stats.screenshot.record_failure(elapsed)
+            logger.warning("Rejected redirect destination for %s: %s", req.url, exc)
+            return Response(
+                body=f'{{"error": "Redirect destination rejected: {exc!s}"}}'.encode(),
+                status_code=400,
+                content_type="application/json",
+            )
         except Exception as exc:
             elapsed = (time.monotonic() - t0) * 1000
+            exc_str = str(exc)
+            if "blockedbyclient" in exc_str or "ERR_BLOCKED_BY_CLIENT" in exc_str:
+                stats.screenshot.record_failure(elapsed)
+                logger.warning("Navigation blocked by outbound policy for %s", req.url)
+                return Response(
+                    body=b'{"error": "Destination blocked by outbound request policy"}',
+                    status_code=400,
+                    content_type="application/json",
+                )
             stats.screenshot.record_failure(elapsed)
             logger.error("Screenshot failed for %s: %s", req.url, exc)
             return Response(

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender/url_validator.py

@@ -2,8 +2,9 @@
 
 Blocks:
 - Non-HTTP(S) schemes: file://, data:, javascript:, ftp://, etc.
-- Private/reserved IP ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12,
-  192.168.0.0/16, 169.254.0.0/16, ::1, fd00::/8, etc.
+- Every address outside the globally routable space, via an ``is_global``
+  allowlist: loopback, RFC1918, link-local (incl. the 169.254.169.254 cloud
+  metadata address), CGNAT 100.64.0.0/10, unique-local, multicast, reserved.
 - DNS resolution is checked before navigation to prevent DNS rebinding.
 """
 
@@ -145,20 +146,59 @@ def _check_resolved_ips(hostname: str) -> None:
 
 
 def _is_blocked_ip(addr: ipaddress.IPv4Address | ipaddress.IPv6Address) -> bool:
-    """Check if an IP address is in a blocked range.
+    """Check whether an IP address is outside the globally routable space.
+
+    This is an allowlist (``is_global``) rather than an enumerated denylist,
+    so ranges that are neither loopback nor ``is_private`` are rejected too:
 
-    Blocks:
         - Loopback (127.0.0.0/8, ::1)
         - Private networks (10/8, 172.16/12, 192.168/16)
-        - Link-local (169.254/16, fe80::/10)
-        - Unique local (fd00::/8)
-        - Multicast, reserved, unspecified
+        - Link-local, including cloud metadata (169.254/16, fe80::/10)
+        - CGNAT / shared address space (100.64.0.0/10)
+        - Unique local (fc00::/7), multicast, reserved, unspecified,
+          benchmarking (198.18.0.0/15) and other special-purpose ranges
+    """
+    return not addr.is_global
+
+
+def is_global_host(hostname: str) -> bool:
+    """Check whether a hostname resolves only to globally routable addresses.
+
+    Callers use this to re-check each request the browser issues, including
+    requests produced by a redirect, so that a public URL cannot bounce a
+    navigation into loopback, an RFC1918 address, or the cloud metadata
+    endpoint.
+
+    Args:
+        hostname: Hostname or IP literal taken from a request URL.
+
+    Returns:
+        True only if the host is an IP literal or resolves exclusively to
+        public addresses. Returns False when resolution fails, so unresolvable
+        hosts are refused rather than attempted.
     """
-    return (
-        addr.is_loopback
-        or addr.is_private
-        or addr.is_reserved
-        or addr.is_multicast
-        or addr.is_link_local
-        or addr.is_unspecified
-    )
+    host = (hostname or "").strip()
+    if host.startswith("[") and host.endswith("]"):
+        host = host[1:-1]
+    if not host:
+        return False
+
+    try:
+        return not _is_blocked_ip(ipaddress.ip_address(host))
+    except ValueError:
+        pass  # Not an IP literal, resolve it below
+
+    try:
+        results = socket.getaddrinfo(host, None, socket.AF_UNSPEC, socket.SOCK_STREAM)
+    except (socket.gaierror, UnicodeError):
+        return False
+
+    for _family, _type, _proto, _canonname, sockaddr in results:
+        try:
+            addr = ipaddress.ip_address(sockaddr[0])
+        except ValueError:
+            continue
+        if _is_blocked_ip(addr):
+            return False
+
+    return bool(results)

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veilrender
-Version: 0.6.2
+Version: 0.6.3
 Summary: Headless browser rendering API — self-hostable on HF Spaces, Docker, or bare metal
 Author: Peng Ding
 License-Expression: MIT

{veilrender-0.6.2 → veilrender-0.6.3}/src/veilrender.egg-info/SOURCES.txt

@@ -36,5 +36,7 @@ src/veilrender/routes/health.py
 src/veilrender/routes/metrics.py
 src/veilrender/routes/render.py
 src/veilrender/routes/screenshot.py
+tests/test_filters.py
 tests/test_fonts.py
-tests/test_models.py
+tests/test_models.py
+tests/test_url_validator.py

veilrender-0.6.3/tests/test_filters.py

@@ -0,0 +1,110 @@
+"""Tests for the outbound request policy enforced on every browser request.
+
+Regression coverage for the redirect-based SSRF: the route handler must refuse
+a request whose destination is not globally routable, so that a public URL
+cannot redirect the navigation into loopback or a cloud metadata endpoint.
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+from veilrender.filters import (
+    _allows_public_destination,
+    make_route_handler,
+    should_block,
+)
+
+
+class _FakeRequest:
+    def __init__(self, url: str) -> None:
+        self.url = url
+
+
+class _FakeRoute:
+    """Stands in for a patchright Route, recording what the handler did."""
+
+    def __init__(self, url: str) -> None:
+        self.request = _FakeRequest(url)
+        self.aborted = False
+        self.continued = False
+        self.abort_reason: str | None = None
+
+    async def abort(self, reason: str | None = None) -> None:
+        self.aborted = True
+        self.abort_reason = reason
+
+    async def continue_(self) -> None:
+        self.continued = True
+
+
+class TestShouldBlockStillWorks:
+    def test_blocks_listed_domain(self) -> None:
+        assert should_block("https://ads.example.com/x", frozenset({"example.com"}))
+
+    def test_allows_unlisted_domain(self) -> None:
+        assert not should_block("https://ok.test/x", frozenset({"example.com"}))
+
+
+class TestAllowsPublicDestination:
+    def test_rejects_loopback(self) -> None:
+        assert (
+            asyncio.run(_allows_public_destination("http://127.0.0.1/", set())) is False
+        )
+
+    def test_rejects_metadata_endpoint(self) -> None:
+        url = "http://169.254.169.254/latest/meta-data/"
+        assert asyncio.run(_allows_public_destination(url, set())) is False
+
+    def test_rejects_cgnat(self) -> None:
+        assert (
+            asyncio.run(_allows_public_destination("http://100.64.0.1/", set()))
+            is False
+        )
+
+    def test_allows_public_literal(self) -> None:
+        assert asyncio.run(_allows_public_destination("http://1.1.1.1/", set())) is True
+
+    def test_allows_inline_scheme(self) -> None:
+        # data:/blob: carry content inline and trigger no fetch.
+        assert (
+            asyncio.run(_allows_public_destination("data:text/html,x", set())) is True
+        )
+
+    def test_rejects_missing_hostname(self) -> None:
+        assert asyncio.run(_allows_public_destination("http:///path", set())) is False
+
+    def test_records_refusal_in_cache(self) -> None:
+        blocked: set[str] = set()
+        asyncio.run(_allows_public_destination("http://127.0.0.1/", blocked))
+        assert "127.0.0.1" in blocked
+
+
+class TestRouteHandlerEnforcesDestination:
+    def test_aborts_redirect_to_loopback(self) -> None:
+        handler = make_route_handler(frozenset())
+        route = _FakeRoute("http://127.0.0.1:7860/health")
+        asyncio.run(handler(route))
+        assert route.aborted
+        assert not route.continued
+
+    def test_continues_public_request(self) -> None:
+        handler = make_route_handler(frozenset())
+        route = _FakeRoute("http://1.1.1.1/")
+        asyncio.run(handler(route))
+        assert route.continued
+        assert not route.aborted
+
+    def test_blocklist_takes_precedence(self) -> None:
+        handler = make_route_handler(frozenset({"ads.example.com"}))
+        route = _FakeRoute("https://ads.example.com/a.js")
+        asyncio.run(handler(route))
+        assert route.aborted
+
+    def test_repeat_private_host_uses_cache(self) -> None:
+        handler = make_route_handler(frozenset())
+        first = _FakeRoute("http://127.0.0.1/a")
+        second = _FakeRoute("http://127.0.0.1/b")
+        asyncio.run(handler(first))
+        asyncio.run(handler(second))
+        assert first.aborted and second.aborted

veilrender-0.6.3/tests/test_url_validator.py

@@ -0,0 +1,91 @@
+"""Tests for URL validation — SSRF guards on the submitted URL.
+
+Regression coverage for the redirect-based SSRF: the validator must reject
+every non-globally-routable destination, not just the historically enumerated
+private ranges (CGNAT 100.64.0.0/10 previously slipped through because the
+check used ``is_private`` instead of ``is_global``).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from veilrender.url_validator import (
+    URLValidationError,
+    is_global_host,
+    validate_url,
+)
+
+
+class TestValidateUrlRejectsNonPublic:
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "http://127.0.0.1/",
+            "http://127.1.2.3:8080/",
+            "http://[::1]/",
+            "http://10.0.0.1/",
+            "http://172.16.5.4/",
+            "http://192.168.1.1/",
+            "http://169.254.169.254/latest/meta-data/",
+            "http://100.64.0.1/",  # CGNAT — the regression
+            "http://100.127.255.254/",  # top of the CGNAT range
+        ],
+    )
+    def test_rejects_non_public_literal(self, url: str) -> None:
+        with pytest.raises(URLValidationError):
+            validate_url(url)
+
+    @pytest.mark.parametrize(
+        "url",
+        [
+            "file:///etc/passwd",
+            "data:text/html,<h1>hi</h1>",
+            "javascript:alert(1)",
+            "ftp://example.com/x",
+        ],
+    )
+    def test_rejects_non_http_scheme(self, url: str) -> None:
+        with pytest.raises(URLValidationError):
+            validate_url(url)
+
+    def test_rejects_localhost_name(self) -> None:
+        # Exercises the DNS path rather than an IP literal.
+        with pytest.raises(URLValidationError):
+            validate_url("http://localhost/")
+
+
+class TestValidateUrlAcceptsPublic:
+    @pytest.mark.parametrize("url", ["http://1.1.1.1/", "https://8.8.8.8/x"])
+    def test_accepts_public_literal(self, url: str) -> None:
+        assert validate_url(url) == url
+
+
+class TestIsGlobalHost:
+    @pytest.mark.parametrize(
+        "host",
+        [
+            "127.0.0.1",
+            "::1",
+            "[::1]",
+            "169.254.169.254",
+            "10.0.0.1",
+            "192.168.0.1",
+            "100.64.0.1",
+            "0.0.0.0",
+            "",
+        ],
+    )
+    def test_false_for_non_public(self, host: str) -> None:
+        assert is_global_host(host) is False
+
+    @pytest.mark.parametrize("host", ["1.1.1.1", "8.8.8.8", "2606:4700:4700::1111"])
+    def test_true_for_public_literal(self, host: str) -> None:
+        assert is_global_host(host) is True
+
+    def test_false_for_localhost_name(self) -> None:
+        assert is_global_host("localhost") is False
+
+    def test_false_when_resolution_fails(self) -> None:
+        # Unresolvable hosts are refused rather than attempted.
+        assert is_global_host("nonexistent.invalid") is False