google-labs-jules[bot]
b5ed16c1c8
The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
1.2 KiB
2024-05-24 - SSRF in WebDAV connection test
Vulnerability: The _test_webdav_connection function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., 127.0.0.1).
Learning: DNS resolution is required for robust SSRF protection when validating URLs provided by users.
Prevention: Use a centralized is_private_ip function (now in app/utils/network.py) that resolves the hostname to its IPs and checks if any are private.
2026-03-22 - B310: urllib.request.urlopen replaced with httpx
Vulnerability: The _test_webdav_connection function used urllib.request.urlopen, which natively supports dangerous schemes like file:// or ftp:// and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
Learning: urllib.request should be avoided for user-supplied URLs. Even when URL schemes are manually validated, urllib's default redirect following behavior can bypass SSRF protections (e.g. redirecting to 127.0.0.1).
Prevention: Use a modern, safer HTTP client like httpx with follow_redirects=False when testing user-provided URLs.