fix(security): Phase 4 edge hardening + SSRF egress guard

Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01): - V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist + DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a validated external URL can't 3xx into an internal target. +33 unit tests. - V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev). - V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer echo ex.Message to clients (logged server-side, generic message returned). - V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config. - V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow). - V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days. - V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, COOP) + HSTS in prod. - V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on. - V-12: API container runs as non-root 'app' user (keys dir pre-owned). - V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no weak default fallback). API compatibility preserved (clamps not rejections; error-body shape changes only on failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-01 00:15:04 +02:00
parent 9ae61432ba
commit 626a9f8454
13 changed files with 295 additions and 25 deletions
@@ -0,0 +1,71 @@
+using System.Net;
+using FluentAssertions;
+using InboxIntel.Infrastructure.Security;
+using Xunit;
+
+namespace InboxIntel.UnitTests;
+
+/// <summary>
+/// SSRF guard (V-01): outbound URLs derived from attacker-authored email headers
+/// must not be allowed to target internal/metadata/private addresses or non-web schemes.
+/// </summary>
+public class SafeHttpGuardTests
+{
+    [Theory]
+    [InlineData("169.254.169.254")] // cloud metadata
+    [InlineData("127.0.0.1")]        // loopback
+    [InlineData("10.0.0.5")]         // private A
+    [InlineData("172.16.4.4")]       // private B
+    [InlineData("172.31.255.255")]   // private B upper bound
+    [InlineData("192.168.1.1")]      // private C
+    [InlineData("100.64.0.1")]       // CGNAT
+    [InlineData("0.0.0.0")]          // this-host
+    [InlineData("255.255.255.255")]  // broadcast
+    [InlineData("224.0.0.1")]        // multicast
+    public void Blocks_private_and_special_ipv4(string ip)
+        => SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeTrue();
+
+    [Theory]
+    [InlineData("::1")]                       // loopback
+    [InlineData("fe80::1")]                   // link-local
+    [InlineData("fc00::1")]                   // unique-local
+    [InlineData("fd12:3456::1")]              // unique-local
+    [InlineData("::ffff:169.254.169.254")]    // v4-mapped metadata
+    [InlineData("::ffff:10.0.0.1")]           // v4-mapped private
+    public void Blocks_private_and_special_ipv6(string ip)
+        => SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeTrue();
+
+    [Theory]
+    [InlineData("8.8.8.8")]
+    [InlineData("93.184.216.34")] // example.com
+    [InlineData("2606:2800:220:1::1")]
+    public void Allows_public_addresses(string ip)
+        => SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeFalse();
+
+    [Theory]
+    [InlineData("ftp://example.com/x")]
+    [InlineData("file:///etc/passwd")]
+    [InlineData("gopher://example.com")]
+    [InlineData("not-a-url")]
+    [InlineData("")]
+    public async Task Rejects_non_http_schemes_and_garbage(string url)
+    {
+        var act = async () => await SafeHttpGuard.ValidateAsync(url);
+        await act.Should().ThrowAsync<SsrfBlockedException>();
+    }
+
+    [Fact]
+    public async Task Rejects_url_resolving_to_loopback()
+    {
+        // localhost resolves to a loopback address and must be blocked.
+        var act = async () => await SafeHttpGuard.ValidateAsync("http://localhost/unsub");
+        await act.Should().ThrowAsync<SsrfBlockedException>();
+    }
+
+    [Fact]
+    public async Task Rejects_literal_metadata_ip_url()
+    {
+        var act = async () => await SafeHttpGuard.ValidateAsync("http://169.254.169.254/latest/meta-data/");
+        await act.Should().ThrowAsync<SsrfBlockedException>();
+    }
+}