Too easy to avoid hostname blocklist in safe_requests #14

Activity

1. tjs-intel commented on Feb 22, 2024

   

   tjs-intel

   on Feb 22, 2024

   Author

   More actions

   @drdavella
2. tjs-intel commented on Feb 22, 2024

   

   tjs-intel

   on Feb 22, 2024

   Last edited by tjs-intel

   Author

   More actions

   There's actually a large number of ways to express 192.168.1.1 as a valid IPv4 address. Here's a small sample of IP addresses that all resolve to 192.168.1.1:

   192.168.257
   192.11010305
   0xC0.168.1.1
   192.168.0x101
   0300.168.0401
   0xC0.052000401
   

   https://linux.die.net/man/3/inet_aton

   The address supplied in cp can have one of the following forms: a.b.c.d, a.b.c, a.b, a
   In all of the above forms, components of the dotted address can be specified in decimal, octal (with a leading 0), or hexadecimal, with a leading 0X).
3. tjs-intel

   changed the title [-]Add some alternatives for 192.168.1.1 and 169.254.169.254 in safe_requests[/-] [+]Too easy to avoid hostname blocklist in `safe_requests`[/+] on Feb 22, 2024
4. drdavella commented on Feb 23, 2024

   

   drdavella

   on Feb 23, 2024

   Contributor

   More actions

   @tjs-intel thanks this is also extremely helpful feedback. It would be good to see whether there's some prior art for this kind of thing or whether we should just build it ourselves.
5. drdavella

   added

   enhancementNew feature or requestNew feature or request

   on Feb 23, 2024
6. tjs-intel commented on Feb 26, 2024

   

   tjs-intel

   on Feb 26, 2024

   Last edited by tjs-intel

   Author

   More actions

   The C implementation of inet_aton can be accessed via socket.inet_aton.

   But you could also enforce that the IPv4 address conforms to the 4-part dotted decimal format, and raise some kind of exception if it doesn't.
7. drdavella commented on Feb 26, 2024

   

   drdavella

   on Feb 26, 2024

   Contributor

   More actions

   But you could also enforce that the IPv4 address conforms to the 4-part dotted decimal format, and raise some kind of exception if it doesn't.

   That seems reasonable to me; @matt- any thoughts?
8. tjs-intel commented on Mar 11, 2024

   

   tjs-intel

   on Mar 11, 2024

   Author

   More actions

   For your consideration https://github.com/stripe/smokescreen
9. drdavella commented on Mar 11, 2024

   

   drdavella

   on Mar 11, 2024

   Contributor

   More actions

   @tjs-intel this is pretty interesting! It would be cool if there were Python bindings or if a similar project existed for native Python. In either case maybe we can use it for inspiration here.