Closed CalemRoelofsSB closed 1 year ago
Great stuff. LGTM at least. Will there be another PR to enable swagger-parser to be configured to use it?
Great stuff. LGTM at least. Will there be another PR to enable swagger-parser to be configured to use it?
@bcoughlan Yes indeed, separate tickets created for parser and codegen implementations that will pull this lib in
This PR adds a new module to the swagger parser repo:
swagger-parser-safe-url-resolver
What is it?
The main class of the package is the
PermittedUrlsChecker
which has one method:verify(String url)
. This method takes in a string URL and performs the following steps:ResolvedUrl
object which contains 4.1. AString url
where the original URL has the hostname replaced with the IP address4.2. A
String hostHeader
which contains the hostname from the original URL to be added as a host headerThis behavior can also be customized with the
allowlist
anddenylist
in the constructor, whereby:allowlist
will allow the URL to pass even if it resolves to a private/restricted IP addressdenylist
will throw an exception even when the URL resolves to a public IP addressWhy is it needed?
This lib can be used in services that deal with user-submitted URLs that get fetched (like in swagger-parser resolving external URL $refs) to protect against Server-Side Request Forgery and DNS rebinding attacks
Example usage