upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-03-21 18:11:02 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Use Symfony IpUtils to check for local IP ranges

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2022-07-12 12:09:05 +02:00
parent 707b46bb01
commit c5ffd7ce32
No known key found for this signature in database
GPG key ID: A3E2F658B28C760A
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/private/Http/Client/LocalAddressChecker.php
View file

@ -27,6 +27,7 @@ namespace OC\Http\Client;
use OCP\Http\Client\LocalServerException;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\IpUtils;
class LocalAddressChecker {
private LoggerInterface $logger;
@ -36,12 +37,15 @@ class LocalAddressChecker {
}
public function ThrowIfLocalIp(string $ip) : void {
$localIps = ['100.100.100.200'];
$localRanges = [
'100.64.0.0/10', // See RFC 6598
'192.0.0.0/24', // See RFC 6890
];
if (
(bool)filter_var($ip, FILTER_VALIDATE_IP) &&
(
!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
in_array($ip, $localIps, true)
IpUtils::checkIp($ip, $localRanges)
)) {
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
throw new LocalServerException('Host violates local access rules');
@ -54,7 +58,7 @@ class LocalAddressChecker {
if (
!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
in_array($ipv4Address, $localIps, true)) {
IpUtils::checkIp($ip, $localRanges)) {
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
throw new LocalServerException('Host violates local access rules');
}

5
tests/lib/Http/Client/LocalAddressCheckerTest.php
View file

@ -96,6 +96,8 @@ class LocalAddressCheckerTest extends \Test\TestCase {
['10.0.0.1'],
['::'],
['::1'],
['100.100.100.200'],
['192.0.0.1'],
];
}
@ -116,6 +118,9 @@ class LocalAddressCheckerTest extends \Test\TestCase {
['another-host.local'],
['service.localhost'],
['!@#$'], // test invalid url
['100.100.100.200'],
['192.0.0.1'],
['randomdomain.internal'],
];
}