Jeremy Daer 496851b255 Security: Web Push SSRF and IP range bypass ...

Add SSRF protection for web push endpoints:
- Resolve endpoint IP once and pin it for connection
- Validate endpoints resolve to public IPs
- Whitelist permitted push service hosts

Add missing IP ranges to SsrfProtection:
- 100.64.0.0/10 (Carrier-grade NAT, RFC6598)
- 198.18.0.0/15 (Benchmark testing, RFC2544)

Note: link-local (169.254.0.0/16) is already covered by ip.link_local?

2025-12-04 21:35:55 -08:00

..

tenanting

This was moved to the gem already by Mike

2025-11-28 15:53:58 +01:00

action_controller_svg_renderer.rb

Extract render svg as a real renderer

2024-10-19 19:31:48 -07:00

action_text.rb

Make sure the image variants we use are preprocessed

2025-07-18 15:43:31 -04:00

active_job.rb

Make sure jobs are enqueued only after all transactions are committed

2025-11-20 18:47:42 -05:00

active_storage.rb

Disable multi-db for SQLite

2025-11-21 09:15:19 +00:00

assets.rb

New Rails app

2024-06-21 13:19:56 +01:00

autotuner.rb

Move yabeda/prometheus stuff to the gem

2025-11-28 15:53:58 +01:00

content_security_policy.rb

New Rails app

2024-06-21 13:19:56 +01:00

database_role_logging.rb

Disable multi-db for SQLite

2025-11-21 09:15:19 +00:00

extensions.rb

Support search on markdown fields

2024-11-29 14:28:37 -06:00

filter_parameter_logging.rb

Set up Rubocop

2024-06-21 16:42:48 +01:00

inflections.rb

Improve naming & remove money accessors

2025-08-25 10:30:43 +02:00

mission_control.rb

Turn off the help notice

2025-12-01 16:25:23 +01:00

multi_db.rb

Merge branch 'main' into sqlite

2025-11-26 10:07:41 +00:00

permissions_policy.rb

New Rails app

2024-06-21 13:19:56 +01:00

rack_mini_profiler.rb

Make sure rack-mini-profiler doesn't load in test

2025-11-17 15:03:26 -05:00

sanitization.rb

Don't lose existing values in case they had been set

2025-10-07 09:42:25 +02:00

sqlite_schema_dumper.rb

Tidy up modules and on_load points

2025-11-26 10:02:32 +00:00

table_definition_column_limits.rb

Handle size in binary columns

2025-12-01 13:32:54 +01:00

true_client_ip.rb

Copy Cloudflare's True-Client-IP header to X-Forwarded-For

2025-11-03 14:22:33 -05:00

uuid_framework_models.rb

Auto default for UUID primary keys

2025-12-03 14:27:52 +00:00

uuid_primary_keys.rb

Auto default for UUID primary keys

2025-12-03 14:27:52 +00:00

vapid.rb

Remove vapid keys in development

2025-11-28 15:53:58 +01:00

web_push.rb

Security: Web Push SSRF and IP range bypass

2025-12-04 21:35:55 -08:00