Documentation
¶
Overview ¶
Package safeurl decides whether an operator-supplied URL may be called from inside the service. A webhook URL is a request the service makes on someone else's say-so, so it must not reach anything the network keeps private: loopback, private ranges, link-local addresses (where cloud metadata lives), or the machine itself. The check runs on the resolved addresses and again at dial time, so a name cannot change its answer between the two.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrScheme is returned for anything but https (or http under // AllowInsecure). ErrScheme = errors.New("safeurl: url must use https") // ErrHost is returned when the URL names no host. ErrHost = errors.New("safeurl: url has no host") // ErrUserinfo is returned when the URL carries credentials. ErrUserinfo = errors.New("safeurl: url must not carry credentials") // ErrNonPublic is returned when the host resolves to an address the // service must not call. ErrNonPublic = errors.New("safeurl: url points at a non-public address") // ErrResolve is returned when the host cannot be resolved at all. ErrResolve = errors.New("safeurl: host does not resolve") )
Functions ¶
func Client ¶
Client returns an HTTP client for calling a validated URL. It resolves the host itself and dials only addresses that pass IsPublic, so a name whose answer changed since Validate is refused rather than followed; it never follows a redirect (the 3xx response is returned as is, for the caller to refuse); and it ignores proxy settings, which would otherwise carry the request somewhere the check never saw.
Types ¶
type Options ¶
type Options struct {
// AllowInsecure permits http and non-public addresses. It is for
// development against a receiver on the same machine and must never be
// set in production.
AllowInsecure bool
// Resolver overrides name resolution; nil uses net.DefaultResolver.
Resolver Resolver
}
Options tune a check.
Source Files