netutil: extract common SSRF and secure-scheme guards #2

+1 -1

appview/serververify/verify.go

Reviewed

··· 12 12 "tangled.org/core/appview/db" 13 13 "tangled.org/core/orm" 14 14 "tangled.org/core/rbac" 15 15 - "tangled.org/core/util/netutil" 15 15 + "tangled.org/core/netutil" 16 16 "tangled.org/core/xrpc/xrpcclient" 17 17 ) 18 18

+1 -1

knotmirror/knotstream/slurper.go

Reviewed

··· 18 18 "tangled.org/core/knotmirror/db" 19 19 "tangled.org/core/knotmirror/models" 20 20 "tangled.org/core/log" 21 21 - "tangled.org/core/util/netutil" 21 21 + "tangled.org/core/netutil" 22 22 ) 23 23 24 24 type KnotSlurper struct {

+1 -1

knotmirror/xrpc/xrpc.go

Reviewed

··· 17 17 "tangled.org/core/knotmirror/knotstream" 18 18 "tangled.org/core/knotmirror/repoindexer" 19 19 "tangled.org/core/log" 20 20 - "tangled.org/core/util/netutil" 20 20 + "tangled.org/core/netutil" 21 21 ) 22 22 23 23 type Xrpc struct {

-51

util/netutil/ssrf.go

Reviewed

··· 1 1 - package netutil 2 2 - 3 3 - import ( 4 4 - "fmt" 5 5 - "net" 6 6 - "net/http" 7 7 - "net/url" 8 8 - 9 9 - "github.com/bluesky-social/indigo/util/ssrf" 10 10 - "github.com/gorilla/websocket" 11 11 - ) 12 12 - 13 13 - // SSRFDialer returns a net.Dialer that refuses non-public IPs. 14 14 - func SSRFDialer(dev bool) *net.Dialer { 15 15 - if dev { 16 16 - return &net.Dialer{} 17 17 - } 18 18 - return ssrf.PublicOnlyDialer() 19 19 - } 20 20 - 21 21 - // SSRFTransport returns an http.Transport that refuses non-public IPs. 22 22 - func SSRFTransport(dev bool) *http.Transport { 23 23 - if dev { 24 24 - return &http.Transport{} 25 25 - } 26 26 - return ssrf.PublicOnlyTransport() 27 27 - } 28 28 - 29 29 - // SSRFWebsocketDialer returns a websocket.Dialer that refuses non-public IPs. 30 30 - func SSRFWebsocketDialer(dev bool) *websocket.Dialer { 31 31 - dialer := *websocket.DefaultDialer 32 32 - dialer.NetDialContext = SSRFDialer(dev).DialContext 33 33 - return &dialer 34 34 - } 35 35 - 36 36 - func EnforceWSSURL(rawURL string, dev bool) (*url.URL, error) { 37 37 - u, err := url.Parse(rawURL) 38 38 - if err != nil { 39 39 - return nil, fmt.Errorf("invalid url: %w", err) 40 40 - } 41 41 - switch u.Scheme { 42 42 - case "wss": 43 43 - case "ws": 44 44 - if !dev { 45 45 - return nil, fmt.Errorf("insecure scheme %q is prohibited in production; use wss://", u.Scheme) 46 46 - } 47 47 - default: 48 48 - return nil, fmt.Errorf("unsupported websocket scheme %q", u.Scheme) 49 49 - } 50 50 - return u, nil 51 51 - }

-17

util/netutil/ssrf_test.go

Reviewed

··· 1 1 - package netutil 2 2 - 3 3 - import ( 4 4 - "testing" 5 5 - 6 6 - "github.com/gorilla/websocket" 7 7 - ) 8 8 - 9 9 - func TestSSRFWebsocketDialerPreservesHandshakeTimeout(t *testing.T) { 10 10 - dialer := SSRFWebsocketDialer(false) 11 11 - if dialer.HandshakeTimeout != websocket.DefaultDialer.HandshakeTimeout { 12 12 - t.Fatalf("HandshakeTimeout = %v, want %v", dialer.HandshakeTimeout, websocket.DefaultDialer.HandshakeTimeout) 13 13 - } 14 14 - if dialer.NetDialContext == nil { 15 15 - t.Fatal("NetDialContext is nil; public-only dialing is not enforced") 16 16 - } 17 17 - }

+51

netutil/ssrf.go

Reviewed

··· 1 1 + package netutil 2 2 + 3 3 + import ( 4 4 + "fmt" 5 5 + "net" 6 6 + "net/http" 7 7 + "net/url" 8 8 + 9 9 + "github.com/bluesky-social/indigo/util/ssrf" 10 10 + "github.com/gorilla/websocket" 11 11 + ) 12 12 + 13 13 + // SSRFDialer returns a net.Dialer that refuses non-public IPs. 14 14 + func SSRFDialer(dev bool) *net.Dialer { 15 15 + if dev { 16 16 + return &net.Dialer{} 17 17 + } 18 18 + return ssrf.PublicOnlyDialer() 19 19 + } 20 20 + 21 21 + // SSRFTransport returns an http.Transport that refuses non-public IPs. 22 22 + func SSRFTransport(dev bool) *http.Transport { 23 23 + if dev { 24 24 + return &http.Transport{} 25 25 + } 26 26 + return ssrf.PublicOnlyTransport() 27 27 + } 28 28 + 29 29 + // SSRFWebsocketDialer returns a websocket.Dialer that refuses non-public IPs. 30 30 + func SSRFWebsocketDialer(dev bool) *websocket.Dialer { 31 31 + dialer := *websocket.DefaultDialer 32 32 + dialer.NetDialContext = SSRFDialer(dev).DialContext 33 33 + return &dialer 34 34 + } 35 35 + 36 36 + func EnforceWSSURL(rawURL string, dev bool) (*url.URL, error) { 37 37 + u, err := url.Parse(rawURL) 38 38 + if err != nil { 39 39 + return nil, fmt.Errorf("invalid url: %w", err) 40 40 + } 41 41 + switch u.Scheme { 42 42 + case "wss": 43 43 + case "ws": 44 44 + if !dev { 45 45 + return nil, fmt.Errorf("insecure scheme %q is prohibited in production; use wss://", u.Scheme) 46 46 + } 47 47 + default: 48 48 + return nil, fmt.Errorf("unsupported websocket scheme %q", u.Scheme) 49 49 + } 50 50 + return u, nil 51 51 + }

+17

netutil/ssrf_test.go

Reviewed

··· 1 1 + package netutil 2 2 + 3 3 + import ( 4 4 + "testing" 5 5 + 6 6 + "github.com/gorilla/websocket" 7 7 + ) 8 8 + 9 9 + func TestSSRFWebsocketDialerPreservesHandshakeTimeout(t *testing.T) { 10 10 + dialer := SSRFWebsocketDialer(false) 11 11 + if dialer.HandshakeTimeout != websocket.DefaultDialer.HandshakeTimeout { 12 12 + t.Fatalf("HandshakeTimeout = %v, want %v", dialer.HandshakeTimeout, websocket.DefaultDialer.HandshakeTimeout) 13 13 + } 14 14 + if dialer.NetDialContext == nil { 15 15 + t.Fatal("NetDialContext is nil; public-only dialing is not enforced") 16 16 + } 17 17 + }