NagVis / nagvis

Visualization addon for your open source monitoring core
http://nagvis.org/
GNU General Public License v2.0
113 stars 73 forks source link

Validate geomap server URL and disable redirects for it #320

Closed dontqwerty closed 1 year ago

dontqwerty commented 1 year ago

This is the PR fixing issue #319.

Description The function validate_geomap_server_base_url takes the geomap server URL as parameter and checks the following:

If one or more of the above checks does not succeed, the function throws an exception.

Furthermore, a modification to the context passed to file_get_contents avoids redirects.

Note An SSRF is still possible, but this solution limits the attack surface without limiting the feature.

LarsMichelsen commented 1 year ago

Thanks for your contribution! :1st_place_medal: