Documentation
¶
Overview ¶
Package ssrf guards outbound webhook and notification delivery against server-side request forgery: a user-supplied URL that points at loopback, the LAN, or a cloud metadata endpoint (169.254.169.254). It offers a create-time URL check for fast feedback and a dial-time Control hook that is the actual security boundary — the hook runs after DNS resolution on the concrete address being dialed, so it also defeats DNS rebinding.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrBlockedAddress = errors.New("URL must not resolve to a private or internal IP address")
ErrBlockedAddress is returned when a URL resolves to, or a connection targets, an internal/private IP that must not be reachable as a delivery destination.
Functions ¶
func IsBlocked ¶
IsBlocked reports whether ip must not be used as a delivery destination. It rejects loopback, link-local, private (RFC 1918 / ULA), CGNAT (RFC 6598), unspecified, and multicast addresses — the ranges an SSRF payload would use to reach cloud metadata, localhost, or the LAN.
func NewHTTPClient ¶
NewHTTPClient returns an http.Client whose dialer blocks connections to internal/private IPs on every hop, including redirects. When allowPrivate is true (dev only, via MAINTENANT_ALLOW_PRIVATE_WEBHOOKS) the guard is disabled.
func ValidateURL ¶
ValidateURL fails fast at create time: it requires an https scheme and rejects hostnames that resolve to a blocked IP. It is a fast-feedback guard — the dial-time Control hook is the true security boundary (it also defeats DNS rebinding between validation and delivery).
Types ¶
This section is empty.
Source Files