Protect hook endpoints against SSRF attacks #2596
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… and django-request-cache to their pypi version
noliveleger
changed the title
jnm
reviewed
Apr 1, 2020
| @@ -113,7 +116,15 @@ def send(self): | |||
| text = response.text | |||
| status_code = response.status_code | |||
| self.save_log(status_code, text) | |||
|
|
|||
| except SSRFProtectException as e: | |||
There was a problem hiding this comment.
I should've brought this up way back in #1864, but these very large try blocks and catch-call except Exception as e handlers should be refactored at some point. In this send() method, for example, I think the only calls that should be inside trys are:
SSRFProtect.validate(self._hook.endpoint)response.raise_for_status()
I'm not sure why except Exception as e is better than letting the exception fall through to Sentry. Maybe I'm forgetting something.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes KPI part of https://github.com/kobotoolbox/tasks/issues/341
Related to kobotoolbox/kobocat#600
Use new package: https://github.com/kobotoolbox/ssrf-protect