ukeeper / ukeeper-readability
78%
master: 78%

LAST BUILD BRANCH: fix/docker-gha-cache
DEFAULT BRANCH: master
Repo Added
Token PvVP7XZODHNMukB1VLWbVHHC4V09CWSI6 regen
Build 273 Last
Files 9
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/ssrf-ip-guard
branch: fix/ssrf-ip-guard
CHANGE BRANCH
x
Sync Branches

coverage: 77.85% (-0.1%) from 77.947%
28705617872

Pull #83

github

paskal 
Block SSRF to non-public addresses via connect-time IP guard

POST /api/extract is unauthenticated and the extractor fetched any URL it
was given with no host validation, so a caller could reach
http://169.254.169.254/... (cloud metadata), localhost and other internal
hosts; image extraction amplified it by following <img src> into more
internal fetches.

The page retriever and image fetcher reject targets that resolve to
loopback, private, link-local, unspecified, multicast and other IANA
special-purpose ranges (0.0.0.0/8, CGNAT, benchmarking, documentation,
reserved, broadcast) via a net.Dialer Control hook that checks the actual
IP at connect time, so it also covers redirect-to-internal and DNS
rebinding; the guarded transport disables env proxies so validation can't
be bypassed through a proxy. extractWithRules additionally validates the
resolved host up front, so the Cloudflare path (which fetches remotely and
isn't covered by the dialer) enforces the same policy.

Image probes share a single lazily-built client (and its guarded transport)
rather than constructing one per <img>, so enabling the guard by default
doesn't churn transports/FDs; the probe request no longer forces
Connection: close, letting the shared client reuse connections.

Enabled by default; operators opt out with --allow-private-networks for
trusted intranet extraction. The default HTTPRetriever inherits the flag
from UReadability so package-level callers are guarded too.
Pull Request #83: Block SSRF to non-public addresses via connect-time IP guard

81 of 101 new or added lines in 5 files covered. (80.2%)

833 of 1070 relevant lines covered (77.85%)

9.26 hits per line

Relevant lines Covered
1070 RELEVANT LINES 833 COVERED LINES
9.26 HITS PER LINE
Source Files on fix/ssrf-ip-guard

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
28705617872 fix/ssrf-ip-guard Block SSRF to non-public addresses via connect-time IP guard POST /api/extract is unauthenticated and the extractor fetched any URL it was given with no host validation, so a caller could reach http://169.254.169.254/... (cloud metadata), localho... Pull #83 paskal github
77.85
28681422902 fix/ssrf-ip-guard Block SSRF to non-public addresses via connect-time IP guard POST /api/extract is unauthenticated and the extractor fetched any URL it was given with no host validation, so a caller could reach http://169.254.169.254/... (cloud metadata), localho... Pull #83 paskal github
77.83
28681139181 fix/ssrf-ip-guard Block SSRF to non-public addresses via connect-time IP guard POST /api/extract is unauthenticated and the extractor fetched any URL it was given with no host validation, so a caller could reach http://169.254.169.254/... (cloud metadata), localho... Pull #83 paskal github
77.77
See All Builds (213)

Badge your Repo: ukeeper-readability

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh