- commit
- 849dd7263f8767ba381c64bb3eec0974c020a642
- parent
- d96b31a2f7589c387df35368fb602f248c525e99
- author
- Dami <dami.etoile@gmail.com>
| M | internal/ | 9 | ++++++--- |
| M | internal/ | 4 | ++++ |
@@ -205,12 +205,15 @@ func (t *Tenant) checkCallbackURL(raw string) error {
205205 return nil206206 }207207 host := strings.ToLower(parsed.Hostname())208+ if ip := net.ParseIP(host); ip != nil {209+ if privateAddress(ip) {210+ return errors.New("invalid: url must not name a private or loopback address")211+ }212+ return nil213+ }208214 if host == "localhost" || strings.HasSuffix(host, ".localhost") || strings.HasSuffix(host, ".local") || strings.HasSuffix(host, ".internal") || !strings.Contains(host, ".") {209215 return errors.New("invalid: url must name a public host")210216 }211- if ip := net.ParseIP(host); ip != nil && privateAddress(ip) {212- return errors.New("invalid: url must not name a private or loopback address")213- }214217 return nil215218 }216219 @@ -100,6 +100,8 @@ func TestCallbackRegistrationValidatesURLFilterScopeAndCap(t *testing.T) {
100100 {"credentials", member, "https://user:pw@hooks.example/wake", `{"kinds":[1]}`, "invalid: url must be https"},101101 {"private address", member, "https://10.0.0.1/wake", `{"kinds":[1]}`, "invalid: url must not name a private"},102102 {"loopback address", member, "https://127.0.0.1/wake", `{"kinds":[1]}`, "invalid: url must not name a private"},103+ {"loopback ipv6", member, "https://[::1]/wake", `{"kinds":[1]}`, "invalid: url must not name a private"},104+ {"shared address", member, "https://100.64.0.9/wake", `{"kinds":[1]}`, "invalid: url must not name a private"},103105 {"localhost", member, "https://localhost/wake", `{"kinds":[1]}`, "invalid: url must name a public host"},104106 {"bare host", member, "https://relay/wake", `{"kinds":[1]}`, "invalid: url must name a public host"},105107 {"no kinds", member, "https://hooks.example/wake", `{"#p":["` + member + `"]}`, "invalid: filter must name at least one kind"},@@ -145,6 +147,8 @@ func TestCallbackRegistrationValidatesURLFilterScopeAndCap(t *testing.T) {
145147 for i := 0; i < 6; i++ {146148 addCallback(t, tenant, owner, "https://hooks.example/owner/"+strconv.Itoa(i), `{"kinds":[1]}`)147149 }150+ // A public address literal is a host like any other.151+ addCallback(t, tenant, owner, "https://[2001:db8::10]/wake", `{"kinds":[1]}`)148152 // The secret shows once: listings and the table row never repeat it.149153 listed, err := tenant.Execute(ctx, agent, "listcallbacks", nil)150154 if err != nil {