Add validation to webhook and service URLs to ensure they are not blocked because of SSRF

3 files changed, 70 insertions, 65 deletions

diff --git a/spec/validators/public_url_validator_spec.rb b/spec/validators/public_url_validator_spec.rb
new file mode 100644
index 00000000000..710dd3dc38e
--- /dev/null
+++ b/spec/validators/public_url_validator_spec.rb
@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe PublicUrlValidator do
+  include_examples 'url validator examples', described_class::DEFAULT_PROTOCOLS
+
+  context 'by default' do
+    let(:validator) { described_class.new(attributes: [:link_url]) }
+    let!(:badge) { build(:badge, link_url: 'http://www.example.com') }
+
+    subject { validator.validate_each(badge, :link_url, badge.link_url) }
+
+    it 'blocks urls pointing to localhost' do
+      badge.link_url = 'https://127.0.0.1'
+
+      subject
+
+      expect(badge.errors.empty?).to be false
+    end
+
+    it 'blocks urls pointing to the local network' do
+      badge.link_url = 'https://192.168.1.1'
+
+      subject
+
+      expect(badge.errors.empty?).to be false
+    end
+  end
+end
diff --git a/spec/validators/url_placeholder_validator_spec.rb b/spec/validators/url_placeholder_validator_spec.rb
deleted file mode 100644
index b76d8acdf88..00000000000
--- a/spec/validators/url_placeholder_validator_spec.rb
+++ /dev/null
@@ -1,39 +0,0 @@
-require 'spec_helper'
-
-describe UrlPlaceholderValidator do
-  let(:validator) { described_class.new(attributes: [:link_url],  **options) }
-  let!(:badge) { build(:badge) }
-  let(:placeholder_url) { 'http://www.example.com/%{project_path}/%{project_id}/%{default_branch}/%{commit_sha}' }
-
-  subject { validator.validate_each(badge, :link_url, badge.link_url) }
-
-  describe '#validates_each' do
-    context 'with no options' do
-      let(:options) { {} }
-
-      it 'allows http and https protocols by default' do
-        expect(validator.send(:default_options)[:protocols]).to eq %w(http https)
-      end
-
-      it 'checks that the url structure is valid' do
-        badge.link_url = placeholder_url
-
-        subject
-
-        expect(badge.errors.empty?).to be false
-      end
-    end
-
-    context 'with placeholder regex' do
-      let(:options) { { placeholder_regex: /(project_path|project_id|commit_sha|default_branch)/ } }
-
-      it 'checks that the url is valid and obviate placeholders that match regex' do
-        badge.link_url = placeholder_url
-
-        subject
-
-        expect(badge.errors.empty?).to be true
-      end
-    end
-  end
-end
diff --git a/spec/validators/url_validator_spec.rb b/spec/validators/url_validator_spec.rb
index 763dff181d2..2d719263fc8 100644
--- a/spec/validators/url_validator_spec.rb
+++ b/spec/validators/url_validator_spec.rb
@@ -1,46 +1,62 @@
 require 'spec_helper'
 
 describe UrlValidator do
-  let(:validator) { described_class.new(attributes: [:link_url],  **options) }
-  let!(:badge) { build(:badge) }
-
+  let!(:badge) { build(:badge, link_url: 'http://www.example.com') }
   subject { validator.validate_each(badge, :link_url, badge.link_url) }
 
-  describe '#validates_each' do
-    context 'with no options' do
-      let(:options) { {} }
+  include_examples 'url validator examples', described_class::DEFAULT_PROTOCOLS
+
+  context 'by default' do
+    let(:validator) { described_class.new(attributes: [:link_url]) }
+
+    it 'does not block urls pointing to localhost' do
+      badge.link_url = 'https://127.0.0.1'
+
+      subject
+
+      expect(badge.errors.empty?).to be true
+    end
+
+    it 'does not block urls pointing to the local network' do
+      badge.link_url = 'https://192.168.1.1'
 
-      it 'allows http and https protocols by default' do
-        expect(validator.send(:default_options)[:protocols]).to eq %w(http https)
-      end
+      subject
 
-      it 'checks that the url structure is valid' do
-        badge.link_url = 'http://www.google.es/%{whatever}'
+      expect(badge.errors.empty?).to be true
+    end
+  end
+
+  context 'when allow_localhost is set to false' do
+    let(:validator) { described_class.new(attributes: [:link_url], allow_localhost: false) }
+
+    it 'blocks urls pointing to localhost' do
+      badge.link_url = 'https://127.0.0.1'
 
-        subject
+      subject
 
-        expect(badge.errors.empty?).to be false
-      end
+      expect(badge.errors.empty?).to be false
     end
+  end
 
-    context 'with protocols' do
-      let(:options) { { protocols: %w(http) } }
+  context 'when allow_local_network is set to false' do
+    let(:validator) { described_class.new(attributes: [:link_url], allow_local_network: false) }
 
-      it 'allows urls with the defined protocols' do
-        badge.link_url = 'http://www.example.com'
+    it 'blocks urls pointing to the local network' do
+      badge.link_url = 'https://192.168.1.1'
 
-        subject
+      subject
 
-        expect(badge.errors.empty?).to be true
-      end
+      expect(badge.errors.empty?).to be false
+    end
+  end
 
-      it 'add error if the url protocol does not match the selected ones' do
-        badge.link_url = 'https://www.example.com'
+  context 'when ports is set' do
+    let(:validator) { described_class.new(attributes: [:link_url], ports: [443]) }
 
-        subject
+    it 'blocks urls with a different port' do
+      subject
 
-        expect(badge.errors.empty?).to be false
-      end
+      expect(badge.errors.empty?).to be false
     end
   end
 end