98f08b7439
The third-party vetting agent runs a suite of HTTP "security" tools on
the internal worker network against a caller-supplied URL that is only
validated for length and charset, not host. Several tools reached
internal, loopback, and link-local addresses:
- analyze_csp used a bare http.Client with no host validation, no
redirect control, and no rebinding-safe transport, reflecting the
target's CSP header back to the caller.
- check_security_headers, fetch_robots_txt, and fetch_sitemap
validated only the initial host, then followed 3xx redirects with an
ordinary client, yielding full-read SSRF via a redirect to an
internal address.
- check_cors validated the URL but still dialed through an ordinary
transport, leaving it exposed to DNS-rebinding TOCTOU.
Route every one of these clients through the house-standard
httpclient.DefaultPooledClient(WithSSRFProtection()), which rejects
dials to loopback, private, CGNAT, link-local, ULA, IPv4-mapped, and
reserved ranges on the resolved peer IP at connect time (defeating DNS
rebinding on every redirect hop) and refuses cross-origin redirects.
download_pdf moves onto the same client, and the now-unused local
netcheck.NewPinnedTransport is removed. analyze_csp also gains an
up-front ValidatePublicURL check for a clean early error and scheme
enforcement.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
89 lines
2.6 KiB
Go
89 lines
2.6 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
// Package netcheck provides shared network validation functions to prevent
|
|
// SSRF attacks and DNS rebinding across agent tool packages.
|
|
package netcheck
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
)
|
|
|
|
// IsPublicIP reports whether ip is a publicly routable address. It returns
|
|
// false for loopback, private, link-local, multicast (any range), and
|
|
// unspecified addresses.
|
|
func IsPublicIP(ip net.IP) bool {
|
|
if ip.IsLoopback() ||
|
|
ip.IsPrivate() ||
|
|
ip.IsLinkLocalUnicast() ||
|
|
ip.IsMulticast() ||
|
|
ip.IsUnspecified() {
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
// ValidatePublicURL checks that rawURL uses an http or https scheme and that
|
|
// its host does not resolve to a private, loopback, or link-local IP address.
|
|
// This prevents SSRF attacks where the LLM could be tricked into requesting
|
|
// internal network endpoints.
|
|
func ValidatePublicURL(rawURL string) error {
|
|
u, err := url.Parse(rawURL)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot parse URL: %w", err)
|
|
}
|
|
|
|
if u.Scheme != "http" && u.Scheme != "https" {
|
|
return fmt.Errorf("unsupported URL scheme %q: only http and https are allowed", u.Scheme)
|
|
}
|
|
|
|
host := u.Hostname()
|
|
if host == "" {
|
|
return fmt.Errorf("URL has no host")
|
|
}
|
|
|
|
ips, err := net.LookupIP(host)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot resolve host %q: %w", host, err)
|
|
}
|
|
|
|
for _, ip := range ips {
|
|
if !IsPublicIP(ip) {
|
|
return fmt.Errorf("host %q resolves to non-public IP %s", host, ip)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ValidatePublicDomain checks that a domain does not resolve to a private,
|
|
// loopback, or link-local IP address.
|
|
func ValidatePublicDomain(domain string) error {
|
|
ips, err := net.LookupIP(domain)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot resolve host %q: %w", domain, err)
|
|
}
|
|
|
|
for _, ip := range ips {
|
|
if !IsPublicIP(ip) {
|
|
return fmt.Errorf("host %q resolves to non-public IP %s", domain, ip)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|