Unverified Commit 5faafd10 authored by Hong Minhee's avatar Hong Minhee
Browse files

Fix SSRF via DNS rebinding 

https://github.com/dahlia/fedify/security/advisories/GHSA-p9cg-vqcc-grcx
parent b03c209d

CHANGES.md

+9 −0
Original line number Diff line number Diff line
@@ -8,6 +8,15 @@ Version 0.9.3 


To be released.



 -  Fixed a vulnerability of SSRF via DNS rebinding in the built-in document

    loader.  [[CVE-2024-39687]]



     -  The `fetchDocumentLoader()` function now throws an error when the given

        domain name has any records referring to a private network address.

     -  The `getAuthenticatedDocumentLoader()` function now returns a document

        loader that throws an error when the given domain name has any records

        referring to a private network address.





Version 0.9.2

-------------

runtime/url.ts

+11 −7
Original line number Diff line number Diff line
@@ -30,7 +30,10 @@ export async function validatePublicUrl(url: string): Promise<void> { 
    const netPermission = await Deno.permissions.query({ name: "net" });

    if (netPermission.state !== "granted") return;

  }

  const { address, family } = await lookup(hostname);

  // To prevent SSRF via DNS rebinding, we need to resolve all IP addresses

  // and ensure that they are all public:

  const addresses = await lookup(hostname, { all: true });

  for (const { address, family } of addresses) {

    if (

      family === 4 && !isValidPublicIPv4Address(address) ||

      family === 6 && !isValidPublicIPv6Address(address) ||
@@ -39,6 +42,7 @@ export async function validatePublicUrl(url: string): Promise<void> { 
      throw new UrlError(`Invalid or private address: ${address}`);

    }

  }

}



export function isValidPublicIPv4Address(address: string): boolean {

  const parts = address.split(".");