includesecurity / safeurl-python Goto Github PK

View Code? Open in Web Editor NEW

11.0 0.0 4.0 17 KB

Python implementation of SafeURL (Anti-SSRF Lib)

Home Page: https://github.com/IncludeSecurity

License: MIT License

Python 100.00%

safeurl ssrf antissrf appsec whitelist blacklist

safeurl-python's People

Contributors

Stargazers

Forkers

momopranto jordanmilne theeyeofhorus ilovewin32k

safeurl-python's Issues

Add address check inside OPENSOCKET callback

pycurl has a hook that can run whenever a socket is opened, with one of the parameters being the resolved IP of the address to connect to (at least according to this unit test.)

If you check the address passed into the callback against the IP whitelist / blacklist you should be able to get rid of the manual DNS pinning, resolving your problems with the CN validation failing with HTTPS.

Unfortunately this callback isn't exposed in PHP so it can't be used in safeurl-php.

Corrupts query strings with %25 → %2525 → %252525 → ⋯

>>> url = 'http://example.com/?q=%25'
>>> url = Url.validateUrl(url, Options())['cleanUrl']; url
'http://example.com/?q=%2525'
>>> url = Url.validateUrl(url, Options())['cleanUrl']; url
'http://example.com/?q=%252525'
>>> url = Url.validateUrl(url, Options())['cleanUrl']; url
'http://example.com/?q=%25252525'
>>> url = Url.validateUrl(url, Options())['cleanUrl']; url
'http://example.com/?q=%2525252525'