Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-10-08 05:16:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

prevent access to ULA and CGNAT addresses

Browse Source
This commit is contained in:
Athou
2026-07-05 08:47:45 +02:00
parent b81aac71f5
commit ca8438623d
3 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
commafeed-server/pom.xml
View File

@@ -1,5 +1,5 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion> <modelVersion>4.0.0</modelVersion>
@@ -461,6 +461,11 @@
<artifactId>dec</artifactId> <artifactId>dec</artifactId>
<version>0.1.2</version> <version>0.1.2</version>
</dependency> </dependency>
<dependency>
<groupId>com.github.seancfoley</groupId>
<artifactId>ipaddress</artifactId>
<version>5.6.2</version>
</dependency>
<!-- test dependencies --> <!-- test dependencies -->
<dependency> <dependency>

8
commafeed-server/src/main/java/com/commafeed/backend/HttpClientFactory.java
View File

@@ -39,6 +39,9 @@ import com.commafeed.CommaFeedConfiguration;
import com.commafeed.CommaFeedVersion; import com.commafeed.CommaFeedVersion;
import com.google.common.net.HttpHeaders; import com.google.common.net.HttpHeaders;
import inet.ipaddr.IPAddress;
import inet.ipaddr.IPAddressNetwork;
import inet.ipaddr.IPAddressString;
import lombok.RequiredArgsConstructor; import lombok.RequiredArgsConstructor;
import nl.altindag.ssl.SSLFactory; import nl.altindag.ssl.SSLFactory;
import nl.altindag.ssl.apache5.util.Apache5SslUtils; import nl.altindag.ssl.apache5.util.Apache5SslUtils;
@@ -48,6 +51,7 @@ import nl.altindag.ssl.apache5.util.Apache5SslUtils;
public class HttpClientFactory { public class HttpClientFactory {
private static final DnsResolver DNS_RESOLVER = SystemDefaultDnsResolver.INSTANCE; private static final DnsResolver DNS_RESOLVER = SystemDefaultDnsResolver.INSTANCE;
private static final IPAddress CGNAT_RANGE = new IPAddressString("100.64.0.0/10").getAddress();
private final CommaFeedConfiguration config; private final CommaFeedConfiguration config;
private final CommaFeedVersion version; private final CommaFeedVersion version;
@@ -111,8 +115,8 @@ public class HttpClientFactory {
} }
private static boolean isLocalAddress(InetAddress address) { private static boolean isLocalAddress(InetAddress address) {
return address.isSiteLocalAddress() || address.isAnyLocalAddress() || address.isLinkLocalAddress() || address.isLoopbackAddress() IPAddress ip = new IPAddressNetwork.IPAddressGenerator().from(address);
|| address.isMulticastAddress(); return ip.isLocal() || ip.isLoopback() || ip.isMulticast() || CGNAT_RANGE.contains(ip);
} }
private record BlockLocalAddressesDnsResolver(DnsResolver delegate) implements DnsResolver { private record BlockLocalAddressesDnsResolver(DnsResolver delegate) implements DnsResolver {

2
commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
View File

@@ -408,11 +408,13 @@ class HttpGetterTest {
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://10.0.0.1")); Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://10.0.0.1"));
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://172.16.0.1")); Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://172.16.0.1"));
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://192.168.0.1")); Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://192.168.0.1"));
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://100.64.0.1"));
} }
@Test @Test
void privateIpv6Ranges() { void privateIpv6Ranges() {
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://[fe80::215:5dff:fe15:102]")); Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://[fe80::215:5dff:fe15:102]"));
Assertions.assertThrows(UnknownHostException.class, () -> getter.get("http://[fd00:dead:beef::50]"));
} }
} }