mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-11-03 07:44:13 +00:00
lukaszraczylo
78db86b455
validateHost and isLoopbackHost matched hostnames by exact string. The spellings localhost. and metadata.google.internal. passed the SSRF check. The check now drops the root dot and any IPv6 zone id first. A bare IPv6 literal without a port no longer fails the host check.
26 lines
724 B
Go
26 lines
724 B
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
func TestValidateHostCanonicalForms(t *testing.T) {
|
|
o := &TraefikOidc{}
|
|
blocked := []string{
|
|
"localhost.", "LOCALHOST.", "metadata.google.internal.", "metadata.google.internal",
|
|
"169.254.169.254.", "fe80::1%eth0", "[fe80::1]", "::1",
|
|
}
|
|
for _, h := range blocked {
|
|
if err := o.validateHost(h); err == nil {
|
|
t.Errorf("validateHost(%q) = nil, want blocked", h)
|
|
}
|
|
}
|
|
allowed := []string{"idp.example.com", "idp.example.com.", "2606:4700::1111"}
|
|
for _, h := range allowed {
|
|
if err := o.validateHost(h); err != nil {
|
|
t.Errorf("validateHost(%q) = %v, want allowed", h, err)
|
|
}
|
|
}
|
|
if !isLoopbackHost("localhost.") {
|
|
t.Error("isLoopbackHost(localhost.) = false")
|
|
}
|
|
}
|