cesnimda
626a9f8454
Backend security fixes from the Phase 1 register / Phase 2 roadmap (PR1 + V-01): - V-01 SSRF: new SafeHttpGuard validates outbound unsubscribe URLs (scheme allowlist + DNS-resolve-and-block private/loopback/link-local/ULA/metadata ranges), wired into UnsubscribeService; the "unsubscribe" HttpClient now disables auto-redirect so a validated external URL can't 3xx into an internal target. +33 unit tests. - V-04: session cookie SecurePolicy=Always in non-dev (SameAsRequest in dev). - V-06: UseExceptionHandler/ProblemDetails in prod; Cleanup/Unsubscribe no longer echo ex.Message to clients (logged server-side, generic message returned). - V-08: ForwardedHeaders trusted only from configurable KnownNetworks (default private ranges) + ForwardLimit, instead of trusting any client. New ForwardedHeaders config. - V-09: returnUrl validated with Url.IsLocalUrl (no open redirect via OAuth flow). - V-10: SearchService clamps Page/PageSize (<=200); Analytics clamps take/days. - V-11: baseline security headers (nosniff, X-Frame-Options DENY, Referrer-Policy, COOP) + HSTS in prod. - V-13: /app/info discloses only devMode to anonymous callers unless dev mode is on. - V-12: API container runs as non-root 'app' user (keys dir pre-owned). - V-03: Postgres + API ports bound to 127.0.0.1; POSTGRES_PASSWORD now required (no weak default fallback). API compatibility preserved (clamps not rejections; error-body shape changes only on failure paths). No DB migrations. Build + all 33 unit tests green. V-15 (MailKit NU1902) persists across versions and the SMTP path is default-off — tracked, not bumped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
72 lines
2.7 KiB
C#
72 lines
2.7 KiB
C#
using System.Net;
|
|
using FluentAssertions;
|
|
using InboxIntel.Infrastructure.Security;
|
|
using Xunit;
|
|
|
|
namespace InboxIntel.UnitTests;
|
|
|
|
/// <summary>
|
|
/// SSRF guard (V-01): outbound URLs derived from attacker-authored email headers
|
|
/// must not be allowed to target internal/metadata/private addresses or non-web schemes.
|
|
/// </summary>
|
|
public class SafeHttpGuardTests
|
|
{
|
|
[Theory]
|
|
[InlineData("169.254.169.254")] // cloud metadata
|
|
[InlineData("127.0.0.1")] // loopback
|
|
[InlineData("10.0.0.5")] // private A
|
|
[InlineData("172.16.4.4")] // private B
|
|
[InlineData("172.31.255.255")] // private B upper bound
|
|
[InlineData("192.168.1.1")] // private C
|
|
[InlineData("100.64.0.1")] // CGNAT
|
|
[InlineData("0.0.0.0")] // this-host
|
|
[InlineData("255.255.255.255")] // broadcast
|
|
[InlineData("224.0.0.1")] // multicast
|
|
public void Blocks_private_and_special_ipv4(string ip)
|
|
=> SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeTrue();
|
|
|
|
[Theory]
|
|
[InlineData("::1")] // loopback
|
|
[InlineData("fe80::1")] // link-local
|
|
[InlineData("fc00::1")] // unique-local
|
|
[InlineData("fd12:3456::1")] // unique-local
|
|
[InlineData("::ffff:169.254.169.254")] // v4-mapped metadata
|
|
[InlineData("::ffff:10.0.0.1")] // v4-mapped private
|
|
public void Blocks_private_and_special_ipv6(string ip)
|
|
=> SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeTrue();
|
|
|
|
[Theory]
|
|
[InlineData("8.8.8.8")]
|
|
[InlineData("93.184.216.34")] // example.com
|
|
[InlineData("2606:2800:220:1::1")]
|
|
public void Allows_public_addresses(string ip)
|
|
=> SafeHttpGuard.IsBlocked(IPAddress.Parse(ip)).Should().BeFalse();
|
|
|
|
[Theory]
|
|
[InlineData("ftp://example.com/x")]
|
|
[InlineData("file:///etc/passwd")]
|
|
[InlineData("gopher://example.com")]
|
|
[InlineData("not-a-url")]
|
|
[InlineData("")]
|
|
public async Task Rejects_non_http_schemes_and_garbage(string url)
|
|
{
|
|
var act = async () => await SafeHttpGuard.ValidateAsync(url);
|
|
await act.Should().ThrowAsync<SsrfBlockedException>();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Rejects_url_resolving_to_loopback()
|
|
{
|
|
// localhost resolves to a loopback address and must be blocked.
|
|
var act = async () => await SafeHttpGuard.ValidateAsync("http://localhost/unsub");
|
|
await act.Should().ThrowAsync<SsrfBlockedException>();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Rejects_literal_metadata_ip_url()
|
|
{
|
|
var act = async () => await SafeHttpGuard.ValidateAsync("http://169.254.169.254/latest/meta-data/");
|
|
await act.Should().ThrowAsync<SsrfBlockedException>();
|
|
}
|
|
}
|