Unleash / unleash / 28358260935

87%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

fix: make addons accept allowlists and deny private ip by default (#12419)

## About the changes 

We want to make sure that our addons do not indiscriminately call any
URL to avoid internal SSRF attacks.
So this PR adds a private URL filter which can be disabled with the
UNLEASH_ALLOW_PRIVATE_URL_IN_INTEGRATION environment variable
and the option for allow listing specific urls which can be configured
using
UNLEASH_ALLOW_LIST_INTEGRATION environment variable

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.

---------

Co-authored-by: Gastón Fournier <gaston@getunleash.io>

Coverage Stats

1907 of 2104 branches covered (90.64%)

75 of 92 new or added lines in 4 files covered. (81.52%)

4 existing lines in 2 files now uncovered.

15346 of 17582 relevant lines covered (87.28%)

902.23 hits per line