In an effort to defend against rebinding attacks more thoroughly, I've done some changes to the HTTP client.
Extracted it from util to a separate file, as it was getting a bit too crowded there
Removed get_reqwest_client and replaced it with make_http_request, which will check the provided URL for possible blacklisted domains/ips or non-global IPs, when relevant.
Added the custom DNS resolver to all HTTP clients, not just icons
Added a redirect policy that checks the targets for possible blacklisted domains/ips or non-global IPs. This is enabled for all HTTP clients as well
Renamed both ICON_BLACKLIST_ settings to HTTP_REQUEST_BLACKLIST_*, to better reflect that this should affect more than just the icons endpoints. We're still reading the old values for backwards compatibility.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/4740
**Author:** [@dani-garcia](https://github.com/dani-garcia)
**Created:** 7/12/2024
**Status:** ✅ Merged
**Merged:** 7/12/2024
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `improved-http-client`
---
### 📝 Commits (3)
- [`bbbbd2f`](https://github.com/dani-garcia/vaultwarden/commit/bbbbd2fb482684149b573aa1acbc98f7fb1408b9) Improved HTTP client
- [`aaf61dc`](https://github.com/dani-garcia/vaultwarden/commit/aaf61dc117d96df153163d390873bbdaec8ec27c) Change config compat to use auto, rename blacklist
- [`3d5b982`](https://github.com/dani-garcia/vaultwarden/commit/3d5b982f6c23f04bde6681266795319c99e4d593) Fix wrong doc references
### 📊 Changes
**12 files changed** (+326 additions, -217 deletions)
<details>
<summary>View changed files</summary>
📝 `.env.template` (+5 -5)
📝 `src/api/admin.rs` (+9 -8)
📝 `src/api/core/mod.rs` (+4 -4)
📝 `src/api/core/two_factor/duo.rs` (+2 -5)
📝 `src/api/icons.rs` (+17 -31)
📝 `src/api/mod.rs` (+1 -1)
📝 `src/api/push.rs` (+17 -10)
📝 `src/config.rs` (+19 -7)
📝 `src/error.rs` (+5 -0)
➕ `src/http_client.rs` (+246 -0)
📝 `src/main.rs` (+1 -0)
📝 `src/util.rs` (+0 -146)
</details>
### 📄 Description
In an effort to defend against rebinding attacks more thoroughly, I've done some changes to the HTTP client.
- Extracted it from `util` to a separate file, as it was getting a bit too crowded there
- Removed `get_reqwest_client` and replaced it with `make_http_request`, which will check the provided URL for possible blacklisted domains/ips or non-global IPs, when relevant.
- Added the custom DNS resolver to all HTTP clients, not just `icons`
- Added a redirect policy that checks the targets for possible blacklisted domains/ips or non-global IPs. This is enabled for all HTTP clients as well
- Renamed both `ICON_BLACKLIST_` settings to `HTTP_REQUEST_BLACKLIST_*`, to better reflect that this should affect more than just the `icons` endpoints. We're still reading the old values for backwards compatibility.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/4740
Author: @dani-garcia
Created: 7/12/2024
Status: ✅ Merged
Merged: 7/12/2024
Merged by: @dani-garcia
Base:
main← Head:improved-http-client📝 Commits (3)
bbbbd2fImproved HTTP clientaaf61dcChange config compat to use auto, rename blacklist3d5b982Fix wrong doc references📊 Changes
12 files changed (+326 additions, -217 deletions)
View changed files
📝
.env.template(+5 -5)📝
src/api/admin.rs(+9 -8)📝
src/api/core/mod.rs(+4 -4)📝
src/api/core/two_factor/duo.rs(+2 -5)📝
src/api/icons.rs(+17 -31)📝
src/api/mod.rs(+1 -1)📝
src/api/push.rs(+17 -10)📝
src/config.rs(+19 -7)📝
src/error.rs(+5 -0)➕
src/http_client.rs(+246 -0)📝
src/main.rs(+1 -0)📝
src/util.rs(+0 -146)📄 Description
In an effort to defend against rebinding attacks more thoroughly, I've done some changes to the HTTP client.
utilto a separate file, as it was getting a bit too crowded thereget_reqwest_clientand replaced it withmake_http_request, which will check the provided URL for possible blacklisted domains/ips or non-global IPs, when relevant.iconsICON_BLACKLIST_settings toHTTP_REQUEST_BLACKLIST_*, to better reflect that this should affect more than just theiconsendpoints. We're still reading the old values for backwards compatibility.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.