2018-10-22 07:00:50 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2017-03-15 20:09:08 +00:00
|
|
|
require 'resolv'
|
2018-11-26 08:45:38 +00:00
|
|
|
require 'ipaddress'
|
2017-03-15 20:09:08 +00:00
|
|
|
|
|
|
|
module Gitlab
|
|
|
|
class UrlBlocker
|
2018-03-28 17:27:16 +00:00
|
|
|
BlockedUrlError = Class.new(StandardError)
|
2017-03-18 17:56:05 +00:00
|
|
|
|
2018-03-28 17:27:16 +00:00
|
|
|
class << self
|
2019-04-21 10:03:26 +00:00
|
|
|
# Validates the given url according to the constraints specified by arguments.
|
|
|
|
#
|
|
|
|
# ports - Raises error if the given URL port does is not between given ports.
|
|
|
|
# allow_localhost - Raises error if URL resolves to a localhost IP address and argument is true.
|
|
|
|
# allow_local_network - Raises error if URL resolves to a link-local address and argument is true.
|
|
|
|
# ascii_only - Raises error if URL has unicode characters and argument is true.
|
|
|
|
# enforce_user - Raises error if URL user doesn't start with alphanumeric characters and argument is true.
|
|
|
|
# enforce_sanitization - Raises error if URL includes any HTML/CSS/JS tags and argument is true.
|
|
|
|
#
|
|
|
|
# Returns an array with [<uri>, <original-hostname>].
|
2019-05-29 16:43:07 +00:00
|
|
|
# rubocop:disable Metrics/ParameterLists
|
|
|
|
def validate!(
|
|
|
|
url,
|
|
|
|
ports: [],
|
|
|
|
schemes: [],
|
|
|
|
allow_localhost: false,
|
|
|
|
allow_local_network: true,
|
|
|
|
ascii_only: false,
|
|
|
|
enforce_user: false,
|
|
|
|
enforce_sanitization: false,
|
|
|
|
dns_rebind_protection: true)
|
|
|
|
# rubocop:enable Metrics/ParameterLists
|
|
|
|
|
2019-04-21 10:03:26 +00:00
|
|
|
return [nil, nil] if url.nil?
|
2017-03-15 20:09:08 +00:00
|
|
|
|
2018-11-28 19:06:44 +00:00
|
|
|
# Param url can be a string, URI or Addressable::URI
|
|
|
|
uri = parse_url(url)
|
2017-03-15 20:09:08 +00:00
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
validate_uri(
|
|
|
|
uri: uri,
|
|
|
|
schemes: schemes,
|
|
|
|
ports: ports,
|
|
|
|
enforce_sanitization: enforce_sanitization,
|
|
|
|
enforce_user: enforce_user,
|
|
|
|
ascii_only: ascii_only
|
|
|
|
)
|
2019-01-07 17:55:21 +00:00
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
normalized_hostname = uri.normalized_host
|
2019-04-21 10:03:26 +00:00
|
|
|
hostname = uri.hostname
|
2019-01-07 17:55:21 +00:00
|
|
|
port = get_port(uri)
|
2019-04-21 10:03:26 +00:00
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
address_info = get_address_info(hostname, port)
|
|
|
|
return [uri, nil] unless address_info
|
2017-03-15 20:09:08 +00:00
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
ip_address = ip_address(address_info)
|
|
|
|
protected_uri_with_hostname = enforce_uri_hostname(ip_address, uri, hostname, dns_rebind_protection)
|
2019-05-29 16:43:07 +00:00
|
|
|
|
2019-04-21 10:03:26 +00:00
|
|
|
# Allow url from the GitLab instance itself but only for the configured hostname and ports
|
2019-05-29 16:43:07 +00:00
|
|
|
return protected_uri_with_hostname if internal?(uri)
|
2019-04-21 10:03:26 +00:00
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
validate_local_request(
|
2019-07-24 17:59:38 +00:00
|
|
|
normalized_hostname: normalized_hostname,
|
2019-07-12 07:04:44 +00:00
|
|
|
address_info: address_info,
|
|
|
|
allow_localhost: allow_localhost,
|
|
|
|
allow_local_network: allow_local_network
|
|
|
|
)
|
2018-04-02 15:13:23 +00:00
|
|
|
|
2019-05-29 16:43:07 +00:00
|
|
|
protected_uri_with_hostname
|
2018-03-28 17:27:16 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def blocked_url?(*args)
|
|
|
|
validate!(*args)
|
|
|
|
|
2017-03-15 20:09:08 +00:00
|
|
|
false
|
2018-03-28 17:27:16 +00:00
|
|
|
rescue BlockedUrlError
|
|
|
|
true
|
2017-03-15 20:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
private
|
|
|
|
|
2019-04-21 10:03:26 +00:00
|
|
|
# Returns the given URI with IP address as hostname and the original hostname respectively
|
|
|
|
# in an Array.
|
|
|
|
#
|
|
|
|
# It checks whether the resolved IP address matches with the hostname. If not, it changes
|
|
|
|
# the hostname to the resolved IP address.
|
|
|
|
#
|
|
|
|
# The original hostname is used to validate the SSL, given in that scenario
|
|
|
|
# we'll be making the request to the IP address, instead of using the hostname.
|
2019-07-29 20:58:44 +00:00
|
|
|
def enforce_uri_hostname(ip_address, uri, hostname, dns_rebind_protection)
|
|
|
|
return [uri, nil] unless dns_rebind_protection && ip_address && ip_address != hostname
|
2019-04-21 10:03:26 +00:00
|
|
|
|
2019-05-29 16:43:07 +00:00
|
|
|
uri = uri.dup
|
|
|
|
uri.hostname = ip_address
|
|
|
|
[uri, hostname]
|
2019-04-21 10:03:26 +00:00
|
|
|
end
|
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
def ip_address(address_info)
|
|
|
|
address_info.first&.ip_address
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_uri(uri:, schemes:, ports:, enforce_sanitization:, enforce_user:, ascii_only:)
|
|
|
|
validate_html_tags(uri) if enforce_sanitization
|
|
|
|
|
|
|
|
return if internal?(uri)
|
|
|
|
|
|
|
|
validate_scheme(uri.scheme, schemes)
|
|
|
|
validate_port(get_port(uri), ports) if ports.any?
|
|
|
|
validate_user(uri.user) if enforce_user
|
|
|
|
validate_hostname(uri.hostname)
|
|
|
|
validate_unicode_restriction(uri) if ascii_only
|
|
|
|
end
|
|
|
|
|
|
|
|
def get_address_info(hostname, port)
|
|
|
|
Addrinfo.getaddrinfo(hostname, port, nil, :STREAM).map do |addr|
|
|
|
|
addr.ipv6_v4mapped? ? addr.ipv6_to_ipv4 : addr
|
|
|
|
end
|
|
|
|
rescue SocketError
|
2019-07-02 16:38:23 +00:00
|
|
|
# In the test suite we use a lot of mocked urls that are either invalid or
|
|
|
|
# don't exist. In order to avoid modifying a ton of tests and factories
|
|
|
|
# we allow invalid urls unless the environment variable RSPEC_ALLOW_INVALID_URLS
|
|
|
|
# is not true
|
|
|
|
return if Rails.env.test? && ENV['RSPEC_ALLOW_INVALID_URLS'] == 'true'
|
|
|
|
|
|
|
|
# If the addr can't be resolved or the url is invalid (i.e http://1.1.1.1.1)
|
|
|
|
# we block the url
|
|
|
|
raise BlockedUrlError, "Host cannot be resolved or invalid"
|
2019-07-12 07:04:44 +00:00
|
|
|
end
|
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
def validate_local_request(
|
|
|
|
normalized_hostname:,
|
|
|
|
address_info:,
|
|
|
|
allow_localhost:,
|
|
|
|
allow_local_network:)
|
2019-07-12 07:04:44 +00:00
|
|
|
return if allow_local_network && allow_localhost
|
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
ip_whitelist, domain_whitelist =
|
|
|
|
Gitlab::CurrentSettings.outbound_local_requests_whitelist_arrays
|
|
|
|
|
|
|
|
return if local_domain_whitelisted?(domain_whitelist, normalized_hostname) ||
|
|
|
|
local_ip_whitelisted?(ip_whitelist, ip_address(address_info))
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
unless allow_localhost
|
|
|
|
validate_localhost(address_info)
|
|
|
|
validate_loopback(address_info)
|
|
|
|
end
|
|
|
|
|
|
|
|
unless allow_local_network
|
|
|
|
validate_local_network(address_info)
|
|
|
|
validate_link_local(address_info)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-01-07 17:55:21 +00:00
|
|
|
def get_port(uri)
|
|
|
|
uri.port || uri.default_port
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_html_tags(uri)
|
2019-01-07 17:55:21 +00:00
|
|
|
uri_str = uri.to_s
|
|
|
|
sanitized_uri = ActionController::Base.helpers.sanitize(uri_str, tags: [])
|
|
|
|
if sanitized_uri != uri_str
|
|
|
|
raise BlockedUrlError, 'HTML/CSS/JS tags are not allowed'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-11-28 19:06:44 +00:00
|
|
|
def parse_url(url)
|
|
|
|
raise Addressable::URI::InvalidURIError if multiline?(url)
|
|
|
|
|
|
|
|
Addressable::URI.parse(url)
|
|
|
|
rescue Addressable::URI::InvalidURIError, URI::InvalidURIError
|
|
|
|
raise BlockedUrlError, 'URI is invalid'
|
|
|
|
end
|
|
|
|
|
|
|
|
def multiline?(url)
|
|
|
|
CGI.unescape(url.to_s) =~ /\n|\r/
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_port(port, ports)
|
2018-04-02 15:13:23 +00:00
|
|
|
return if port.blank?
|
|
|
|
# Only ports under 1024 are restricted
|
|
|
|
return if port >= 1024
|
2018-06-01 11:43:53 +00:00
|
|
|
return if ports.include?(port)
|
2018-04-02 15:13:23 +00:00
|
|
|
|
2018-06-01 11:43:53 +00:00
|
|
|
raise BlockedUrlError, "Only allowed ports are #{ports.join(', ')}, and any over 1024"
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_scheme(scheme, schemes)
|
2019-04-11 06:29:07 +00:00
|
|
|
if scheme.blank? || (schemes.any? && !schemes.include?(scheme))
|
|
|
|
raise BlockedUrlError, "Only allowed schemes are #{schemes.join(', ')}"
|
2018-06-01 11:43:53 +00:00
|
|
|
end
|
2018-04-02 15:13:23 +00:00
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_user(value)
|
2018-04-02 15:13:23 +00:00
|
|
|
return if value.blank?
|
|
|
|
return if value =~ /\A\p{Alnum}/
|
2017-03-15 20:09:08 +00:00
|
|
|
|
2018-04-02 15:13:23 +00:00
|
|
|
raise BlockedUrlError, "Username needs to start with an alphanumeric character"
|
2017-03-15 20:09:08 +00:00
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_hostname(value)
|
2018-04-02 15:13:23 +00:00
|
|
|
return if value.blank?
|
2018-11-26 08:45:38 +00:00
|
|
|
return if IPAddress.valid?(value)
|
2018-04-02 15:13:23 +00:00
|
|
|
return if value =~ /\A\p{Alnum}/
|
2017-08-08 17:36:24 +00:00
|
|
|
|
2018-11-26 08:45:38 +00:00
|
|
|
raise BlockedUrlError, "Hostname or IP address invalid"
|
2018-04-02 15:13:23 +00:00
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_unicode_restriction(uri)
|
2018-12-05 20:14:09 +00:00
|
|
|
return if uri.to_s.ascii_only?
|
|
|
|
|
|
|
|
raise BlockedUrlError, "URI must be ascii only #{uri.to_s.dump}"
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_localhost(addrs_info)
|
2018-11-26 08:45:38 +00:00
|
|
|
local_ips = ["::", "0.0.0.0"]
|
2018-04-02 15:13:23 +00:00
|
|
|
local_ips.concat(Socket.ip_address_list.map(&:ip_address))
|
|
|
|
|
|
|
|
return if (local_ips & addrs_info.map(&:ip_address)).empty?
|
|
|
|
|
|
|
|
raise BlockedUrlError, "Requests to localhost are not allowed"
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_loopback(addrs_info)
|
2018-09-06 04:41:59 +00:00
|
|
|
return unless addrs_info.any? { |addr| addr.ipv4_loopback? || addr.ipv6_loopback? }
|
|
|
|
|
|
|
|
raise BlockedUrlError, "Requests to loopback addresses are not allowed"
|
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_local_network(addrs_info)
|
2018-11-26 08:45:38 +00:00
|
|
|
return unless addrs_info.any? { |addr| addr.ipv4_private? || addr.ipv6_sitelocal? || addr.ipv6_unique_local? }
|
2018-04-02 15:13:23 +00:00
|
|
|
|
|
|
|
raise BlockedUrlError, "Requests to the local network are not allowed"
|
2017-08-08 17:36:24 +00:00
|
|
|
end
|
|
|
|
|
2019-07-12 07:04:44 +00:00
|
|
|
def validate_link_local(addrs_info)
|
2018-08-11 10:38:21 +00:00
|
|
|
netmask = IPAddr.new('169.254.0.0/16')
|
|
|
|
return unless addrs_info.any? { |addr| addr.ipv6_linklocal? || netmask.include?(addr.ip_address) }
|
|
|
|
|
|
|
|
raise BlockedUrlError, "Requests to the link local network are not allowed"
|
|
|
|
end
|
|
|
|
|
2017-03-15 20:09:08 +00:00
|
|
|
def internal?(uri)
|
|
|
|
internal_web?(uri) || internal_shell?(uri)
|
|
|
|
end
|
|
|
|
|
|
|
|
def internal_web?(uri)
|
2018-11-28 18:37:12 +00:00
|
|
|
uri.scheme == config.gitlab.protocol &&
|
|
|
|
uri.hostname == config.gitlab.host &&
|
2017-03-15 20:09:08 +00:00
|
|
|
(uri.port.blank? || uri.port == config.gitlab.port)
|
|
|
|
end
|
|
|
|
|
|
|
|
def internal_shell?(uri)
|
2018-11-28 18:37:12 +00:00
|
|
|
uri.scheme == 'ssh' &&
|
|
|
|
uri.hostname == config.gitlab_shell.ssh_host &&
|
2017-03-15 20:09:08 +00:00
|
|
|
(uri.port.blank? || uri.port == config.gitlab_shell.ssh_port)
|
|
|
|
end
|
|
|
|
|
2019-07-24 17:59:38 +00:00
|
|
|
def local_ip_whitelisted?(ip_whitelist, ip_string)
|
|
|
|
ip_obj = Gitlab::Utils.string_to_ip_object(ip_string)
|
|
|
|
|
|
|
|
ip_whitelist.any? { |ip| ip.include?(ip_obj) }
|
|
|
|
end
|
|
|
|
|
|
|
|
def local_domain_whitelisted?(domain_whitelist, domain_string)
|
|
|
|
domain_whitelist.include?(domain_string)
|
|
|
|
end
|
|
|
|
|
2017-03-15 20:09:08 +00:00
|
|
|
def config
|
|
|
|
Gitlab.config
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|