google-labs-jules[bot]
b5ed16c1c8
The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
9 lines
1.2 KiB
Markdown
9 lines
1.2 KiB
Markdown
## 2024-05-24 - SSRF in WebDAV connection test
|
|
**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
|
|
**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
|
|
**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
|
|
## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx
|
|
**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
|
|
**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`).
|
|
**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs.
|