Remove IPv4 ranges the SSRF guard's predicates already cover#2989
Open
djmb wants to merge 1 commit into
Open
Conversation
The RFC1918, loopback, and link-local ranges in DISALLOWED_IP_RANGES duplicated the private?/loopback?/link_local? checks that run right before the list scan, so they could never be the deciding factor. Keep only the ranges the predicates don't catch.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is a small follow-up to #2988 that simplifies SsrfProtection::DISALLOWED_IP_RANGES by removing IPv4 RFC1918/loopback/link-local ranges that are already blocked earlier via IPAddr predicate checks in disallowed_ipv4?, keeping behavior unchanged while reducing dead entries.
Changes:
- Remove RFC1918, loopback, and link-local IPv4 ranges from
DISALLOWED_IP_RANGESsince they’re already covered byprivate?,loopback?, andlink_local?. - Update the inline comment to reflect that
DISALLOWED_IP_RANGESonly needs to contain ranges not caught by those predicates.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+11
to
+12
| # IPv4 special-use ranges (RFC 5735/6890) not already covered by the | ||
| # private?/loopback?/link_local? predicates in #blocked_address?. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow-up to #2988, which expanded
SsrfProtection::DISALLOWED_IP_RANGESto the full IANA special-use registry — but five of the added entries (10.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16) duplicate theprivate?/loopback?/link_local?predicate checks that run right before the list scan inblocked_address?, so they can never be the deciding factor.Fix
Trim the list to only the ranges the predicates don't catch. No behavior change — the existing tests asserting RFC1918/loopback/link-local addresses are blocked all still pass via the predicates.
Tests
bin/rails test test/models/ssrf_protection_test.rb→ 25 tests, 0 failures.Same cleanup applied to the once-campfire counterpart in basecamp/once-campfire#225 (80fdd44).