Forbid non-HTTP/HTTPS URLs for requests and do not allow redirect to such URLs

toland / patron

Ruby HTTP client based on libcurl

http://toland.github.com/patron/

MIT License

541 stars 73 forks source link

Forbid non-HTTP/HTTPS URLs for requests and do not allow redirect to such URLs #129

Closed julik closed 8 years ago

julik commented 8 years ago

I think this is going to be a good security-minded check (see the imgur SSRF drama, which involved leading curl to a non-authorised URL by doing a remote-fetch-by-proxy).

julik commented 8 years ago

According to CURL devs this is not detectable, so I think I'll just go and enable it. If people are running curl that is older they are exposing themselves to vulnerabilities. Also we should document the minimum supported curl in the README

toland commented 8 years ago

LGTM. I have been traveling the last few days, thanks for following up on this.