ac/ac-ms-url-shortener
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-ms-url-shortener synced 2026-07-29 03:38:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

allow f0xx.org domains in URL normalizer SSRF guard

Browse Source 
The project's own domains (f0xx.org and *.f0xx.org) resolve to
private/internal IPs inside the cluster network, causing the SSRF
guard to block legitimate shortening requests for internal services
such as Alertmanager notifications.  Add an explicit early-return
for f0xx.org and sub-domains before the private-IP check.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-06-26 22:09:02 +02:00
parent 0f9f68dadd
commit 106e9ad52a
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/UrlNormalizer.php
View File

@@ -42,6 +42,11 @@ final class UrlNormalizer {
if ($host === 'metadata.google.internal' || $host === 'metadata') { if ($host === 'metadata.google.internal' || $host === 'metadata') {
throw new InvalidArgumentException('blocked host'); throw new InvalidArgumentException('blocked host');
} }
// Project-owned apex domain and all sub-domains are always allowed regardless of
// where their DNS resolves to inside the cluster network.
if ($host === 'f0xx.org' || str_ends_with($host, '.f0xx.org')) {
return;
}
if (filter_var($host, FILTER_VALIDATE_IP)) { if (filter_var($host, FILTER_VALIDATE_IP)) {
self::assertIpAllowed($host); self::assertIpAllowed($host);
return; return;