fizzy

bterkuile/fizzy

Fork 0

Commit Graph

Author	SHA1	Message	Date
Kevin McConnell	23fe40fa81	Correctly initialise WebPush connection (#2417 ) The `ipaddr` arg here is being interpreted as a positional arg (since the keyword arg doesn't exist), which results in an invalid connection object. This was causing push notifications to silently fail. We should initialise the property on the object instead.	2026-01-22 12:03:02 -08:00
Jeremy Daer	496851b255	Security: Web Push SSRF and IP range bypass Add SSRF protection for web push endpoints: - Resolve endpoint IP once and pin it for connection - Validate endpoints resolve to public IPs - Whitelist permitted push service hosts Add missing IP ranges to SsrfProtection: - 100.64.0.0/10 (Carrier-grade NAT, RFC6598) - 198.18.0.0/15 (Benchmark testing, RFC2544) Note: link-local (169.254.0.0/16) is already covered by ip.link_local?	2025-12-04 21:35:55 -08:00
Jason Zimdars	e59a994a0c	Add db table and models	2025-07-14 19:57:30 -05:00

Author

SHA1

Message

Date

Kevin McConnell

23fe40fa81

Correctly initialise WebPush connection (#2417 )

The `ipaddr` arg here is being interpreted as a positional arg (since
the keyword arg doesn't exist), which results in an invalid connection
object. This was causing push notifications to silently fail.

We should initialise the property on the object instead.

2026-01-22 12:03:02 -08:00

Jeremy Daer

496851b255

Security: Web Push SSRF and IP range bypass

Add SSRF protection for web push endpoints:
- Resolve endpoint IP once and pin it for connection
- Validate endpoints resolve to public IPs
- Whitelist permitted push service hosts

Add missing IP ranges to SsrfProtection:
- 100.64.0.0/10 (Carrier-grade NAT, RFC6598)
- 198.18.0.0/15 (Benchmark testing, RFC2544)

Note: link-local (169.254.0.0/16) is already covered by ip.link_local?

2025-12-04 21:35:55 -08:00

Jason Zimdars

e59a994a0c

Add db table and models

2025-07-14 19:57:30 -05:00

3 Commits