cozy / cozy-stack

Simple, Versatile, Yours
https://docs.cozy.io/en/cozy-stack/
GNU Affero General Public License v3.0
1.11k stars 137 forks source link

Forbid IP like 169.254.169.254 in safehttp #4384

Closed nono closed 3 months ago

nono commented 3 months ago

Safehttp package is used to prevent Server-Side Requests Forgery. It prevents making HTTP requests to private IP addresses for things controlled by the user, like Bitwarden icons. This commit adds some more rules for link-local unicast and multicast.

Fix #4380

sblaisot commented 3 months ago

LGTM