CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-06 10:07:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add central helper for ssrf address protection

Browse Source
This commit is contained in:
Kara Engelhardt
2026-07-20 17:20:38 +02:00
parent d47c435489
commit 6d01029e9f
3 changed files with 27 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/base/email.py
+4 -13
View File
@@ -19,7 +19,6 @@
# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
# <https://www.gnu.org/licenses/>.
#
import ipaddress
import logging
import smtplib
import socket
@@ -52,13 +51,12 @@ from pretix.base.services.placeholders import ( # noqa
SimpleFunctionalTextPlaceholder as SimpleFunctionalMailTextPlaceholder,
)
from pretix.base.settings import get_name_parts_localized # noqa
from pretix.helpers.ssrf import should_block_access
logger = logging.getLogger('pretix.base.email')
T = TypeVar("T", bound=EmailBackend)
_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
def test_custom_smtp_backend(backend: T, from_addr: str) -> None:
try:
@@ -254,16 +252,9 @@ def create_connection(address, timeout=socket.getdefaulttimeout(),
af, socktype, proto, canonname, sa = res
if not getattr(settings, "MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS", False):
ip_addr = ipaddress.ip_address(sa[0])
check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
if ip_addr.is_multicast:
raise socket.error(f"Request to multicast address {sa[0]} blocked")
if ip_addr.is_loopback or ip_addr.is_link_local:
raise socket.error(f"Request to local address {sa[0]} blocked")
if ip_addr.is_private:
raise socket.error(f"Request to private address {sa[0]} blocked")
if check_ip4 in _cgnat_net:
raise socket.error(f"Request to RFC 6598 address {sa[0]} blocked")
is_private, msg = should_block_access(sa)
if is_private:
raise socket.error(msg)
sock = None
try:
src/pretix/helpers/monkeypatching.py
+4 -13
View File
@@ -19,7 +19,6 @@
# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
# <https://www.gnu.org/licenses/>.
#
import ipaddress
import socket
import sys
import types
@@ -42,8 +41,7 @@ from urllib3.util.connection import (
from urllib3.util.timeout import _DEFAULT_TIMEOUT
from pretix.helpers.reportlab import ThumbnailingImageReader
_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
from pretix.helpers.ssrf import should_block_access
def monkeypatch_vobject_performance():
@@ -150,16 +148,9 @@ def monkeypatch_urllib3_ssrf_protection():
af, socktype, proto, canonname, sa = res
if not getattr(settings, "ALLOW_HTTP_TO_PRIVATE_NETWORKS", False):
ip_addr = ipaddress.ip_address(sa[0])
check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
if ip_addr.is_multicast:
raise HTTPError(f"Request to multicast address {sa[0]} blocked")
if ip_addr.is_loopback or ip_addr.is_link_local:
raise HTTPError(f"Request to local address {sa[0]} blocked")
if ip_addr.is_private:
raise HTTPError(f"Request to private address {sa[0]} blocked")
if check_ip4 in _cgnat_net:
raise HTTPError(f"Request to RFC 6598 address {sa[0]} blocked")
is_private, msg = should_block_access(sa)
if is_private:
raise HTTPError(msg)
sock = None
try:
src/pretix/helpers/ssrf.py
+19
View File
@@ -0,0 +1,19 @@
import ipaddress
_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
def should_block_access(sa):
ip_addr = ipaddress.ip_address(sa[0])
check_ip4 = ip_addr.ipv4_mapped if getattr(ip_addr, "ipv4_mapped", None) else ip_addr
if ip_addr.is_multicast:
return True, f"Request to multicast address {sa[0]} blocked"
if ip_addr.is_loopback or ip_addr.is_link_local:
return True, f"Request to local address {sa[0]} blocked"
if ip_addr.is_private:
return True, f"Request to private address {sa[0]} blocked"
if check_ip4 in _cgnat_net:
return True, f"Request to RFC 6598 address {sa[0]} blocked"
return False, None