[pull] develop from baserow:develop#366
Merged
Merged
Conversation
* fix: guard data sync and SSO outbound requests against SSRF Route the GitLab data sync issue fetch and the OpenID Connect well-known and JWKS fetches through the advocate library instead of plain requests, so that user/admin configured URLs can't be used to reach Baserow's internal network. The behaviour is controlled by two new settings, BASEROW_DATA_SYNC_ALLOW_PRIVATE_ADDRESS and BASEROW_SSO_ALLOW_PRIVATE_ADDRESS, both defaulting to blocking private addresses. Also strictly validate the workspace import manifest version before using it to build a schema file path, preventing path traversal from an untrusted uploaded archive. * fix: address review feedback on SSRF guard settings - Move BASEROW_SSO_ALLOW_PRIVATE_ADDRESS to the enterprise settings module. - Drop the settings comments that re-explained the env vars. - Add breaking change changelog entries for both new defaults. - Cover the blocked private address paths for GitLab data sync and the OpenID Connect well-known fetch, and the unknown manifest schema version. * fix: guard Jira data sync and OAuth2 token/user info fetches against SSRF The Jira issues data sync passed the user configured jira_url to the atlassian client, which uses a plain requests session. It now gets an advocate session gated by BASEROW_DATA_SYNC_ALLOW_PRIVATE_ADDRESS, and a blocked address becomes a clear sync error. The OAuth2 token and user info endpoints come from the provider's well-known document, which the guard on the base URL doesn't constrain. The OAuth2 session now mounts advocate's validating adapter, gated by BASEROW_SSO_ALLOW_PRIVATE_ADDRESS. * fix: parse SSRF guard env vars with str_to_bool bool(os.getenv(...)) treats "false" and "0" as enabled, which would silently disable the SSRF guard. Also reword the bug changelog entry to cover the manifest fix instead of duplicating the breaking change entries. * fix: list new SSRF guard env vars in .env.example * fix: address PR review feedback (#5489) - default both allow-private-address settings to true for backward compat - scope the SSO OAuth2 session guard to providers with configurable URLs - route iCal data sync through the guarded request helper - clarify blocked-URL errors to mention non-standard ports - validate import manifest version against supported versions - use whitelisted ports in private-IP tests so the IP check is exercised * fix: treat empty SSRF env vars as unset so defaults apply
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )