fizzy

bterkuile/fizzy

Fork 0

Commit Graph

Author	SHA1	Message	Date
Mike Dalessio	56f47361f9	Fix flaky web push test and deduplicate DNS stub helper (#2825 ) * Extract shared DnsTestHelper from duplicated stub_dns_resolution methods * Fix flaky WebTest by stubbing DNS resolution for push subscription creation	2026-04-09 14:03:45 -04:00
Robin Brandt	d60643f5ef	Allow chromium unstable endpoint	2025-12-09 20:24:09 -05:00
Jeremy Daer	496851b255	Security: Web Push SSRF and IP range bypass Add SSRF protection for web push endpoints: - Resolve endpoint IP once and pin it for connection - Validate endpoints resolve to public IPs - Whitelist permitted push service hosts Add missing IP ranges to SsrfProtection: - 100.64.0.0/10 (Carrier-grade NAT, RFC6598) - 198.18.0.0/15 (Benchmark testing, RFC2544) Note: link-local (169.254.0.0/16) is already covered by ip.link_local?	2025-12-04 21:35:55 -08:00

Author

SHA1

Message

Date

Mike Dalessio

56f47361f9

Fix flaky web push test and deduplicate DNS stub helper (#2825 )

* Extract shared DnsTestHelper from duplicated stub_dns_resolution methods

* Fix flaky WebTest by stubbing DNS resolution for push subscription creation

2026-04-09 14:03:45 -04:00

Robin Brandt

d60643f5ef

Allow chromium unstable endpoint

2025-12-09 20:24:09 -05:00

Jeremy Daer

496851b255

Security: Web Push SSRF and IP range bypass

Add SSRF protection for web push endpoints:
- Resolve endpoint IP once and pin it for connection
- Validate endpoints resolve to public IPs
- Whitelist permitted push service hosts

Add missing IP ranges to SsrfProtection:
- 100.64.0.0/10 (Carrier-grade NAT, RFC6598)
- 198.18.0.0/15 (Benchmark testing, RFC2544)

Note: link-local (169.254.0.0/16) is already covered by ip.link_local?

2025-12-04 21:35:55 -08:00

3 Commits