mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-04 21:02:35 +08:00
c8e551820b
This routes external downloads used by webhook fetch used by macros and acutomations through SafeFetch. It closes the SSRF exposure from raw Down.download paths, preserves provider-specific auth and header flows, and adds regression coverage for blocked internal URLs plus authenticated downloads. Fixes # (issue): [CW-6940](https://linear.app/chatwoot/issue/CW-6940/ssrf-via-webhooksautomationmacros-non-upload-non-avatar)
43 lines
1.3 KiB
Ruby
43 lines
1.3 KiB
Ruby
require 'ssrf_filter'
|
|
|
|
module SafeFetch
|
|
DEFAULT_ALLOWED_CONTENT_TYPE_PREFIXES = %w[image/ video/].freeze
|
|
DEFAULT_ALLOWED_CONTENT_TYPES = [].freeze
|
|
DEFAULT_SENSITIVE_HEADERS = %w[authorization cookie proxy-authorization].freeze
|
|
DEFAULT_OPEN_TIMEOUT = 2
|
|
DEFAULT_READ_TIMEOUT = 20
|
|
DEFAULT_MAX_BYTES_FALLBACK_MB = 40
|
|
|
|
Result = Data.define(:tempfile, :filename, :content_type) do
|
|
def original_filename
|
|
filename
|
|
end
|
|
end
|
|
|
|
class Error < StandardError; end
|
|
class InvalidUrlError < Error; end
|
|
class UnsafeUrlError < Error; end
|
|
class FetchError < Error; end
|
|
class HttpError < Error; end
|
|
class FileTooLargeError < Error; end
|
|
class UnsupportedContentTypeError < Error; end
|
|
class UnsupportedMethodError < Error; end
|
|
end
|
|
|
|
require_relative 'safe_fetch/request_options'
|
|
require_relative 'safe_fetch/fetcher'
|
|
|
|
module SafeFetch
|
|
def self.fetch(url, **, &)
|
|
raise ArgumentError, 'block required' unless block_given?
|
|
|
|
Fetcher.new(RequestOptions.new(url: url, **)).fetch(&)
|
|
rescue SsrfFilter::InvalidUriScheme, URI::InvalidURIError => e
|
|
raise InvalidUrlError, e.message
|
|
rescue SsrfFilter::Error, Resolv::ResolvError => e
|
|
raise UnsafeUrlError, e.message
|
|
rescue Net::OpenTimeout, Net::ReadTimeout, SocketError, OpenSSL::SSL::SSLError => e
|
|
raise FetchError, e.message
|
|
end
|
|
end
|