diff --git a/app/models/ssrf_protection.rb b/app/models/ssrf_protection.rb index f3df2511b..257debd87 100644 --- a/app/models/ssrf_protection.rb +++ b/app/models/ssrf_protection.rb @@ -1,8 +1,13 @@ -module SsrfProtection +module SSRFProtection extend self DNS_RESOLUTION_TIMEOUT = 2 + DNS_NAMESERVERS = %w[ + 1.1.1.1 + 8.8.8.8 + ] + DISALLOWED_IP_RANGES = [ IPAddr.new("0.0.0.0/8") # Broadcasts ].freeze @@ -22,7 +27,7 @@ module SsrfProtection def resolve_dns(hostname) ip_addresses = [] - Resolv::DNS.open(timeouts: DNS_RESOLUTION_TIMEOUT) do |dns| + Resolv::DNS.open(nameserver: DNS_NAMESERVERS, timeouts: DNS_RESOLUTION_TIMEOUT) do |dns| dns.each_address(hostname) do |ip_address| ip_addresses << IPAddr.new(ip_address.to_s) end diff --git a/app/models/webhook/delivery.rb b/app/models/webhook/delivery.rb index b635baac5..daf540106 100644 --- a/app/models/webhook/delivery.rb +++ b/app/models/webhook/delivery.rb @@ -70,7 +70,7 @@ class Webhook::Delivery < ApplicationRecord def resolved_ip return @resolved_ip if defined?(@resolved_ip) - @resolved_ip = SsrfProtection.resolve_public_ip(uri.host) + @resolved_ip = SSRFProtection.resolve_public_ip(uri.host) end def uri diff --git a/config/initializers/inflections.rb b/config/initializers/inflections.rb index 62ffe294f..7e49acd7e 100644 --- a/config/initializers/inflections.rb +++ b/config/initializers/inflections.rb @@ -13,6 +13,7 @@ # These inflection rules are supported but not enabled by default: ActiveSupport::Inflector.inflections(:en) do |inflect| inflect.acronym "SQLite" + inflect.acronym "SSRF" inflect.singular "quotas", "quota" inflect.plural "quota", "quotas"