CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-17 11:56:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260)

Browse Source 
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)

* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
This commit is contained in:
Raphael Michel
2026-06-26 16:45:20 +02:00
committed by GitHub
co-authored by pajowu
parent a8997f8971
commit 1f5fe1b237
4 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/helpers/monkeypatching.py
+2 -1
View File
@@ -151,13 +151,14 @@ def monkeypatch_urllib3_ssrf_protection():
if not getattr(settings, "ALLOW_HTTP_TO_PRIVATE_NETWORKS", False):
ip_addr = ipaddress.ip_address(sa[0])
check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
if ip_addr.is_multicast:
raise HTTPError(f"Request to multicast address {sa[0]} blocked")
if ip_addr.is_loopback or ip_addr.is_link_local:
raise HTTPError(f"Request to local address {sa[0]} blocked")
if ip_addr.is_private:
raise HTTPError(f"Request to private address {sa[0]} blocked")
if ip_addr in _cgnat_net:
if check_ip4 in _cgnat_net:
raise HTTPError(f"Request to RFC 6598 address {sa[0]} blocked")
sock = None