Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ContextType = types.NewOpaqueType("http.Context")
var DefaultBlockedCIDRs = []string{
"127.0.0.0/8",
"::1/128",
"169.254.0.0/16",
"fe80::/10",
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"fc00::/7",
"100.64.0.0/10",
}
DefaultBlockedCIDRs is the default set of CIDR ranges blocked to prevent SSRF attacks. It covers loopback, link-local (cloud metadata), RFC-1918 private, and shared address space.
var DefaultBlockedHosts = []string{
"metadata.google.internal",
"metadata.internal",
}
DefaultBlockedHosts is the default set of hostnames blocked to prevent SSRF attacks. These are cloud provider metadata endpoints whose IPs may not always fall in DefaultBlockedCIDRs.
Functions ¶
Types ¶
type Context ¶
type Context struct {
ContextInterface
}
type ContextInterface ¶
type ContextInterface interface {
Get(url string, headers map[string]string) (any, error)
Post(url string, data any, headers map[string]string) (any, error)
Client(caBundle string) (ContextInterface, error)
}
func NewHTTP ¶
func NewHTTP() ContextInterface
NewHTTP creates a ContextInterface with no URL restrictions. Intended for testing and internal use. For production admission controllers use NewHTTPWithDefaultBlocklist or NewHTTPWithBlocklist.
func NewHTTPWithBlocklist ¶
func NewHTTPWithBlocklist(blocklist, allowlist []string) (ContextInterface, error)
NewHTTPWithBlocklist creates a ContextInterface with configurable URL validation.
blocklist entries may be:
- CIDR ranges (e.g. "10.0.0.0/8"): the resolved IP of any requested host is checked against these.
- Hostnames (e.g. "metadata.google.internal"): matched against the exact request hostname.
allowlist entries are URL prefixes (scheme + host, optionally + path prefix). When the allowlist is non-empty, a request URL must match at least one entry — scheme and host must be identical and the request path must start with the entry's path. The blocklist is still enforced on top of the allowlist for defence in depth.
func NewHTTPWithDefaultBlocklist ¶
func NewHTTPWithDefaultBlocklist() ContextInterface
NewHTTPWithDefaultBlocklist creates a ContextInterface with the default SSRF blocklist applied. It panics if the default blocklist contains an invalid entry, which indicates a programming error.
Source Files