parththakkar106andClaude Opus 4.8
c500203270
The per-IP rate limits could be bypassed entirely: uvicorn ran with --forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value (client-controlled), and Render forwards the inbound header rather than stripping it. Rotating the header handed out a fresh rate-limit bucket per request, so the login/register limit (10/5min) and guest-minting limit (30/5min) were no throttle at all — unbounded password guessing and guest-row creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header -> no 429 across 14 attempts. Two-layer fix: - limits._client_ip now derives the client IP from the hop the trusted edge appends (rightmost of X-Forwarded-For), which a client can't spoof past; tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*". - New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on success): stops distributed guessing against one account that a per-IP limit can't, since it can't be diluted across many source addresses. Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection test and turn/chat streams now refuse a URL that resolves to a non-public address (private/loopback/link-local metadata/reserved), checked at request time so it resists a DNS record flipping to a private IP. No-op locally, where reaching localhost Ollama is intended. Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7
52 lines
2.1 KiB
Python
52 lines
2.1 KiB
Python
"""SSRF guard for the one place the server makes an outbound request to a
|
|
user-supplied address: the BYOK `endpoint_url` (connection test + turns/chat).
|
|
|
|
Without this, a hosted user could point endpoint_url at an internal service or
|
|
the cloud metadata endpoint (169.254.169.254) and have the server fetch it —
|
|
the connection test even echoes part of the response back. We refuse any URL
|
|
that resolves to a non-public address.
|
|
|
|
No-op in local mode: a local install talking to http://localhost:11434 (Ollama)
|
|
is the normal, intended case — the guard only applies to the hosted, multi-user
|
|
deployment where the endpoint comes from an untrusted visitor.
|
|
"""
|
|
|
|
import ipaddress
|
|
import socket
|
|
from urllib.parse import urlparse
|
|
|
|
from . import auth
|
|
|
|
|
|
def endpoint_block_reason(url: str) -> str | None:
|
|
"""A human-readable reason this URL must NOT be fetched server-side, or None
|
|
if it's allowed. Resolves the host and rejects it if any resulting address
|
|
is non-public (private, loopback, link-local/metadata, reserved, …).
|
|
|
|
Checking at request time (not just on save) is deliberate: it resists a DNS
|
|
record that flips to a private IP after the value was stored.
|
|
"""
|
|
if not auth.MULTI_USER:
|
|
return None
|
|
parsed = urlparse(url)
|
|
if parsed.scheme not in ("http", "https"):
|
|
return "the endpoint URL must start with http:// or https://"
|
|
host = parsed.hostname
|
|
if not host:
|
|
return "the endpoint URL has no host"
|
|
port = parsed.port or (443 if parsed.scheme == "https" else 80)
|
|
try:
|
|
infos = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
|
|
except socket.gaierror:
|
|
return "the endpoint host could not be resolved"
|
|
for info in infos:
|
|
try:
|
|
ip = ipaddress.ip_address(info[4][0])
|
|
except ValueError:
|
|
return "the endpoint host resolved to an unrecognized address"
|
|
# is_global is the strict allowlist: private/loopback/link-local/CGNAT
|
|
# all report False, so this one check covers the metadata IP too.
|
|
if not ip.is_global or ip.is_multicast or ip.is_reserved:
|
|
return "the endpoint URL resolves to a non-public address"
|
|
return None
|