Skip to content

Commit

Permalink
resovle host to all ips and check against the deny list
Browse files Browse the repository at this point in the history
Signed-off-by: Amardeepsingh Siglani <amardeep7194@gmail.com>
  • Loading branch information
amsiglan committed Sep 24, 2024
1 parent 1eaa37c commit 35e1ac0
Show file tree
Hide file tree
Showing 3 changed files with 49 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -49,13 +49,32 @@ fun isValidUrl(urlString: String): Boolean {
}
}

"foobar.com"



fun isHostInDenylist(urlString: String, hostDenyList: List<String>): Boolean {
val url = URL(urlString)
if (url.host != null) {
val ipStr = IPAddressString(InetAddress.getByName(url.host).hostAddress)
val resolvedIps = InetAddress.getAllByName(url.host);
val resolvedIpStrings = resolvedIps.map { inetAddress -> IPAddressString(inetAddress.hostAddress) }
val hostStr = HostName(url.host)

for (network in hostDenyList) {
val netStr = IPAddressString(network)
if (netStr.contains(ipStr)) {
val denyIpStr = IPAddressString(network)
val denyHostStr = HostName(network)
val hostInDenyList = denyHostStr.equals(hostStr);
var ipInDenyList = false;

for (ipStr in resolvedIpStrings) {
if (denyIpStr.contains(ipStr)) {
ipInDenyList = true;
break;
}
}

if (hostInDenyList || ipInDenyList) {
LogManager.getLogger().error("${url.host} is denied")
return true
}
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import org.apache.hc.client5.http.classic.methods.HttpPost
import org.apache.hc.client5.http.classic.methods.HttpPut
import org.apache.logging.log4j.LogManager
import org.opensearch.core.common.Strings
import java.net.InetAddress
import java.net.URL

fun validateUrl(urlString: String) {
Expand All @@ -38,12 +39,24 @@ fun isValidUrl(urlString: String): Boolean {
fun isHostInDenylist(urlString: String, hostDenyList: List<String>): Boolean {
val url = URL(urlString)
if (url.host != null) {
val ipStr = IPAddressString(url.host)
val resolvedIps = InetAddress.getAllByName(url.host);
val resolvedIpStrings = resolvedIps.map { inetAddress -> IPAddressString(inetAddress.hostAddress) }
val hostStr = HostName(url.host)

for (network in hostDenyList) {
val denyIpStr = IPAddressString(network)
val denyHostStr = HostName(network)
if (denyIpStr.contains(ipStr) || denyHostStr.equals(hostStr)) {
val hostInDenyList = denyHostStr.equals(hostStr);
var ipInDenyList = false;

for (ipStr in resolvedIpStrings) {
if (denyIpStr.contains(ipStr)) {
ipInDenyList = true;
break;
}
}

if (hostInDenyList || ipInDenyList) {
LogManager.getLogger().error("${url.host} is denied")
return true
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,4 +44,16 @@ internal class ValidationHelpersTests {
assertEquals(false, isHostInDenylist("https://$url", hostDenyList), "address $url was not supposed to be identified as in the deny list, but was")
}
}

@Test
fun `test hostname gets resolved to ip for denylist`() {
val invalidHost = "invalid.com"
mockkStatic(InetAddress::class)
every { InetAddress.getByName(invalidHost).hostAddress } returns "10.0.0.1" // 10.0.0.0/8
assertEquals(true, isHostInDenylist("https://$invalidHost", hostDenyList))

val validHost = "valid.com"
every { InetAddress.getByName(validHost).hostAddress } returns "174.12.0.0"
assertEquals(false, isHostInDenylist("https://$validHost", hostDenyList))
}
}

0 comments on commit 35e1ac0

Please sign in to comment.