17 Commits (ba94de2510b3858f10d60f0230a58b1252346372)

Author	SHA1	Message	Date
Robin Kluth	414f8f1f2d	Include `hostName:$port` for Host access violation message as well ... Signed-off-by: Robin Kluth <Commifreak@users.noreply.github.com>	2 years ago
Robin Kluth	25c0021137	Log Host/IP in `LocalServerException` for `Host violates local access rules` ... Signed-off-by: Robin Kluth <Commifreak@users.noreply.github.com>	2 years ago
Daniel Kesselberg	f8f985602b	test: add tests for dns pin middleware ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago
Daniel Kesselberg	03f1f1ed2e	enh: skip processing for empty response ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	2 years ago
Christoph Wurst	ce259435c2	Fix DNS Pin Middleware throwing for public IPs ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	8aea25b5b9	Add remote host validation API ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Christoph Wurst	d4b9b010b0	Rename LocalAddressChecker methods to lower case ... Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>	3 years ago
Côme Chilliet	a907b74c2a	Add missing urldecode and idn_to_utf8 calls to local address checker ... The call to idn_to_utf8 call is actually to apply normalization Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>	3 years ago
Lukas Reschke	84d9b17dc7	Check for !== false instead ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago
Lukas Reschke	b0cef8827d	Check if dns_get_record returns non-false ... `dns_get_record` can return false which results in exceptions such as the ones shown in https://github.com/nextcloud/server/issues/27870. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago
Sanpi	81c272a8a5	Fixes recursion count incrementation ... Signed-off-by: Sanpi <sanpi@homecomputing.fr>	5 years ago
Daniel Kesselberg	b6530e5e82	Ignore subdomain for soa queries ... Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>	5 years ago
Aaron Ball	484913dc31	Fix DnsPinMiddleware resolve pinning bug ... Libcurl expects the value of the CURLOPT_RESOLVE configurations to be an array of strings, those strings containing a comma delimited list of resolved IPs for each host:port combination. The original code here does create that array with the host:port:ip combination, but multiple ips for a single host:port result in additional array entries, rather than adding them to the end of the string with a comma. Per the libcurl docs, the `CURLOPT_RESOLVE` array entries should match the syntax `host:port:address[,address]`. This creates a function-scoped associative array which uses `host:port` as the key (which are supposed to be unique and this ensures that), and the value is an array containing IP strings (ipv4 or ipv6). Once the associative array is populated, it is then set to the CURLOPT_RESOLVE array, imploding the ip arrays using a comma delimiter so the array syntax matches the expected by libcurl. Note that this reorders the "foreach ip" and "foreach port" loops. Rather than looping over ips then ports, we now loop over ports then ips, since ports are part of the unique host:port map, and multiple ips can exist therein. Signed-off-by: Aaron Ball <nullspoon@oper.io>	5 years ago
John Molakvoæ (skjnldsv)	215aef3cbd	Update php licenses ... Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>	5 years ago
Lukas Reschke	5fe1f134f9	Strictify null check ... Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago
Lukas Reschke	5f3abffe6f	Improve networking checks ... Whilst we currently state that SSRF is generally outside of our threat model, this is something where we should invest to improve this. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>	5 years ago