summaryrefslogtreecommitdiff
path: root/spec/initializers
diff options
context:
space:
mode:
authorGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-08-29 21:33:42 +0000
committerGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-08-29 21:33:42 +0000
commit15b88fe57faff899b76d24e41985d83612c7de3a (patch)
tree09b3494babb92a07b6c7214c09ab628a6ce632b1 /spec/initializers
parent60e2a1db28075877e3777d87d2dddcb7a98ed9f1 (diff)
parentd1de6fd4d867ee817a1979e05344e580d33c7759 (diff)
downloadgitlab-ce-15b88fe57faff899b76d24e41985d83612c7de3a.tar.gz
Merge branch 'security-ssrf-kubernetes-dns-12-3' into 'master'
DNS Rebind SSRF in Kubernetes Integration See merge request gitlab/gitlabhq!3345
Diffstat (limited to 'spec/initializers')
-rw-r--r--spec/initializers/rest-client-hostname_override_spec.rb147
1 files changed, 147 insertions, 0 deletions
diff --git a/spec/initializers/rest-client-hostname_override_spec.rb b/spec/initializers/rest-client-hostname_override_spec.rb
new file mode 100644
index 00000000000..3707e001d41
--- /dev/null
+++ b/spec/initializers/rest-client-hostname_override_spec.rb
@@ -0,0 +1,147 @@
+require 'spec_helper'
+
+describe 'rest-client dns rebinding protection' do
+ include StubRequests
+
+ context 'when local requests are not allowed' do
+ it 'allows an external request with http' do
+ request_stub = stub_full_request('http://example.com', ip_address: '93.184.216.34')
+
+ RestClient.get('http://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'allows an external request with https' do
+ request_stub = stub_full_request('https://example.com', ip_address: '93.184.216.34')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'raises error when it is a request that resolves to a local address' do
+ stub_full_request('https://example.com', ip_address: '172.16.0.0')
+
+ expect { RestClient.get('https://example.com') }
+ .to raise_error(ArgumentError,
+ "URL 'https://example.com' is blocked: Requests to the local network are not allowed")
+ end
+
+ it 'raises error when it is a request that resolves to a localhost address' do
+ stub_full_request('https://example.com', ip_address: '127.0.0.1')
+
+ expect { RestClient.get('https://example.com') }
+ .to raise_error(ArgumentError,
+ "URL 'https://example.com' is blocked: Requests to localhost are not allowed")
+ end
+
+ it 'raises error when it is a request to local address' do
+ expect { RestClient.get('http://172.16.0.0') }
+ .to raise_error(ArgumentError,
+ "URL 'http://172.16.0.0' is blocked: Requests to the local network are not allowed")
+ end
+
+ it 'raises error when it is a request to localhost address' do
+ expect { RestClient.get('http://127.0.0.1') }
+ .to raise_error(ArgumentError,
+ "URL 'http://127.0.0.1' is blocked: Requests to localhost are not allowed")
+ end
+ end
+
+ context 'when port different from URL scheme is used' do
+ it 'allows the request' do
+ request_stub = stub_full_request('https://example.com:8080', ip_address: '93.184.216.34')
+
+ RestClient.get('https://example.com:8080/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'raises error when it is a request to local address' do
+ expect { RestClient.get('https://172.16.0.0:8080') }
+ .to raise_error(ArgumentError,
+ "URL 'https://172.16.0.0:8080' is blocked: Requests to the local network are not allowed")
+ end
+
+ it 'raises error when it is a request to localhost address' do
+ expect { RestClient.get('https://127.0.0.1:8080') }
+ .to raise_error(ArgumentError,
+ "URL 'https://127.0.0.1:8080' is blocked: Requests to localhost are not allowed")
+ end
+ end
+
+ context 'when DNS rebinding protection is disabled' do
+ before do
+ stub_application_setting(dns_rebinding_protection_enabled: false)
+ end
+
+ it 'allows the request' do
+ request_stub = stub_request(:get, 'https://example.com')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+ end
+
+ context 'when http(s) proxy environment variable is set' do
+ before do
+ stub_env('https_proxy' => 'https://my.proxy')
+ end
+
+ it 'allows the request' do
+ request_stub = stub_request(:get, 'https://example.com')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+ end
+
+ context 'when local requests are allowed' do
+ before do
+ stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
+ end
+
+ it 'allows an external request' do
+ request_stub = stub_full_request('https://example.com', ip_address: '93.184.216.34')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'allows an external request that resolves to a local address' do
+ request_stub = stub_full_request('https://example.com', ip_address: '172.16.0.0')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'allows an external request that resolves to a localhost address' do
+ request_stub = stub_full_request('https://example.com', ip_address: '127.0.0.1')
+
+ RestClient.get('https://example.com/')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'allows a local address request' do
+ request_stub = stub_request(:get, 'http://172.16.0.0')
+
+ RestClient.get('http://172.16.0.0')
+
+ expect(request_stub).to have_been_requested
+ end
+
+ it 'allows a localhost address request' do
+ request_stub = stub_request(:get, 'http://127.0.0.1')
+
+ RestClient.get('http://127.0.0.1')
+
+ expect(request_stub).to have_been_requested
+ end
+ end
+end