1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
# frozen_string_literal: true
RSpec.shared_examples 'a request using Gitlab::UrlBlocker' do
# Written to test internal patches against 3rd party libraries
#
# Expects the following to be available in the example contexts:
#
# make_request(uri): Wraps the request we want to test goes through Gitlab::HTTP
# http_method: :get, :post etc
# url_blocked_error_class: Probably just Gitlab::HTTP::BlockedUrlError
include StubRequests
context 'when local requests are not allowed' do
it 'allows an external request with http' do
request_stub = stub_full_request('http://example.com', method: http_method, ip_address: '93.184.216.34')
make_request('http://example.com/')
expect(request_stub).to have_been_requested
end
it 'allows an external request with https' do
request_stub = stub_full_request('https://example.com', method: http_method, ip_address: '93.184.216.34')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
it 'raises error when it is a request that resolves to a local address' do
stub_full_request('https://example.com', method: http_method, ip_address: '172.16.0.0')
expect { make_request('https://example.com') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to the local network are not allowed"
)
end
it 'raises error when it is a request that resolves to a localhost address' do
stub_full_request('https://example.com', method: http_method, ip_address: '127.0.0.1')
expect { make_request('https://example.com') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to localhost are not allowed"
)
end
it 'raises error when it is a request to local address' do
expect { make_request('http://172.16.0.0') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to the local network are not allowed"
)
end
it 'raises error when it is a request to localhost address' do
expect { make_request('http://127.0.0.1') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to localhost are not allowed"
)
end
end
context 'when port different from URL scheme is used' do
it 'allows the request' do
request_stub = stub_full_request('https://example.com:8080', method: http_method, ip_address: '93.184.216.34')
make_request('https://example.com:8080/')
expect(request_stub).to have_been_requested
end
it 'raises error when it is a request to local address' do
expect { make_request('https://172.16.0.0:8080') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to the local network are not allowed"
)
end
it 'raises error when it is a request to localhost address' do
expect { make_request('https://127.0.0.1:8080') }.to raise_error(
url_blocked_error_class,
"URL is blocked: Requests to localhost are not allowed"
)
end
end
context 'when DNS rebinding protection is disabled' do
before do
stub_application_setting(dns_rebinding_protection_enabled: false)
end
it 'allows the request' do
request_stub = stub_request(http_method, 'https://example.com')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
end
context 'when http(s) proxy environment variable is set' do
before do
stub_env('https_proxy' => 'https://my.proxy')
end
it 'allows the request' do
request_stub = stub_request(http_method, 'https://example.com')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
end
context 'when local requests are allowed' do
before do
stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
end
it 'allows an external request' do
request_stub = stub_full_request('https://example.com', method: http_method, ip_address: '93.184.216.34')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
it 'allows an external request that resolves to a local address' do
request_stub = stub_full_request('https://example.com', method: http_method, ip_address: '172.16.0.0')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
it 'allows an external request that resolves to a localhost address' do
request_stub = stub_full_request('https://example.com', method: http_method, ip_address: '127.0.0.1')
make_request('https://example.com/')
expect(request_stub).to have_been_requested
end
it 'allows a local address request' do
request_stub = stub_request(http_method, 'http://172.16.0.0')
make_request('http://172.16.0.0')
expect(request_stub).to have_been_requested
end
it 'allows a localhost address request' do
request_stub = stub_request(http_method, 'http://127.0.0.1')
make_request('http://127.0.0.1')
expect(request_stub).to have_been_requested
end
end
context 'when a non HTTP/HTTPS URL is provided' do
it 'raises an error' do
expect { make_request('ssh://example.com') }
.to raise_error(ArgumentError)
end
end
end
|
