SSRF — Müşterinin Verdiği Adresi Sunucu Neden Çağırmamalı?

1
@Component
2
class InvoiceUrlPolicy {
3

4
    private final RegisteredInvoiceHosts hosts;
5

6
    InvoiceUrlPolicy(RegisteredInvoiceHosts hosts) {
7
        this.hosts = hosts;
8
    }
9

10
    /** Returns the one address we will connect to, or throws. */
11
    InetAddress approve(UUID customerId, URI uri) {
12
        if (!"https".equals(uri.getScheme())) {
13
            throw new RejectedUrlException("Yalnızca https adresleri kabul edilir.");
14
        }
15
        if (!hosts.isRegistered(customerId, uri.getHost())) {
16
            throw new RejectedUrlException("Bu alan adı fatura adresi olarak kayıtlı değil.");
17
        }
18
        try {
19
            InetAddress address = InetAddress.getByName(uri.getHost()); // resolve once
20
            if (address.isLoopbackAddress() || address.isLinkLocalAddress()
21
                    || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {
22
                throw new RejectedUrlException("Adres iç ağa çıkıyor.");
23
            }
24
            return address;
25
        } catch (UnknownHostException e) {
26
            throw new RejectedUrlException("Alan adı çözülemedi.");
27
        }
28
    }
29
}

1
@Service
2
class InvoiceDownloader {
3

4
    private static final long MAX_BYTES = 10 * 1024 * 1024;
5

6
    private final InvoiceUrlPolicy policy;
7
    private final HttpClient http = HttpClient.newBuilder()
8
            .followRedirects(HttpClient.Redirect.NEVER) // a redirect could lead inside
9
            .connectTimeout(Duration.ofSeconds(3))
10
            .build();
11

12
    InvoiceDownloader(InvoiceUrlPolicy policy) {
13
        this.policy = policy;
14
    }
15

16
    byte[] download(UUID customerId, URI uri) throws IOException, InterruptedException {
17
        InetAddress approved = policy.approve(customerId, uri);
18
        // Production code pins the connection to `approved` (custom DNS resolver or
19
        // socket factory) so a second lookup cannot return a different address.
20
        HttpResponse<InputStream> response = http.send(
21
                HttpRequest.newBuilder(uri).timeout(Duration.ofSeconds(10)).GET().build(),
22
                HttpResponse.BodyHandlers.ofInputStream());
23
        if (response.statusCode() != 200) {
24
            throw new RejectedUrlException("Fatura indirilemedi: " + response.statusCode());
25
        }
26
        try (InputStream body = response.body()) {
27
            return body.readNBytes((int) MAX_BYTES);
28
        }
29
    }
30
}

1
apiVersion: networking.k8s.io/v1
2
kind: NetworkPolicy
3
metadata:
4
  name: corporate-egress
5
spec:
6
  podSelector:
7
    matchLabels:
8
      app: corporate
9
  policyTypes: [Egress]
10
  egress:
11
    - to:
12
        - ipBlock:
13
            cidr: 0.0.0.0/0
14
            except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16]
15
      ports:
16
        - port: 443
17
          protocol: TCP