Module: WSDL::HTTP::RedirectGuard Private

Included in:

Client

Defined in:

lib/wsdl/http/redirect_guard.rb

Overview

This module is part of a private API. You should avoid using this module if possible, as it may be removed or be changed in the future.

SSRF and redirect validation for Client.

This module validates redirect targets to prevent Server-Side Request Forgery (SSRF) attacks. It blocks redirects to private/reserved IP addresses and prevents HTTPS-to-HTTP scheme downgrades.

Both IP address literals in URLs and DNS-resolved addresses are checked.

Constant Summary

DNS_RESOLUTION_TIMEOUT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Timeout in seconds for DNS resolution during redirect validation. Prevents indefinite hangs when resolving redirect target hostnames.

Note: this timeout applies per redirect hop, so worst-case DNS latency across a full redirect chain is max_redirects × DNS_RESOLUTION_TIMEOUT (default: 5 × 5 = 25 seconds), on top of connection/read timeouts.

5

PRIVATE_IP_RANGES =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Private/reserved IPv4 and IPv6 ranges that must not be redirect targets.

[
  IPAddr.new('0.0.0.0/8'),          # Current network (RFC 1122)
  IPAddr.new('10.0.0.0/8'),         # Private (RFC 1918)
  IPAddr.new('100.64.0.0/10'),      # Shared address space (RFC 6598)
  IPAddr.new('127.0.0.0/8'),        # Loopback (RFC 1122)
  IPAddr.new('169.254.0.0/16'),     # Link-local (RFC 3927)
  IPAddr.new('172.16.0.0/12'),      # Private (RFC 1918)
  IPAddr.new('192.0.0.0/24'),       # IETF protocol assignments (RFC 6890)
  IPAddr.new('192.0.2.0/24'),       # Documentation TEST-NET-1 (RFC 5737)
  IPAddr.new('192.88.99.0/24'),     # 6to4 relay anycast (RFC 7526)
  IPAddr.new('192.168.0.0/16'),     # Private (RFC 1918)
  IPAddr.new('198.18.0.0/15'),      # Benchmarking (RFC 2544)
  IPAddr.new('198.51.100.0/24'),    # Documentation TEST-NET-2 (RFC 5737)
  IPAddr.new('203.0.113.0/24'),     # Documentation TEST-NET-3 (RFC 5737)
  IPAddr.new('240.0.0.0/4'),        # Reserved for future use (RFC 1112)
  IPAddr.new('255.255.255.255/32'), # Broadcast
  IPAddr.new('::/128'),             # IPv6 unspecified (RFC 4291)
  IPAddr.new('::1/128'),            # IPv6 loopback
  IPAddr.new('64:ff9b::/96'),       # NAT64 well-known prefix (RFC 6052)
  IPAddr.new('64:ff9b:1::/48'),     # NAT64 local-use prefix (RFC 8215)
  IPAddr.new('100::/64'),           # Discard-only prefix (RFC 6666)
  IPAddr.new('2001::/32'),          # Teredo tunneling (RFC 4380)
  IPAddr.new('2001:10::/28'),       # ORCHID addresses (RFC 4843)
  IPAddr.new('2001:db8::/32'),      # IPv6 documentation (RFC 3849)
  IPAddr.new('2002::/16'),          # 6to4 addresses (RFC 3056)
  IPAddr.new('fc00::/7'),           # IPv6 unique local (RFC 4193)
  IPAddr.new('fe80::/10')           # IPv6 link-local
].freeze

SENSITIVE_HEADERS =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future.

Headers that must be stripped when following a redirect to a different origin. Prevents credential leakage on cross-origin 307/308 redirects where the method, headers, and body are preserved.

%w[
  authorization
  cookie
  proxy-authorization
].freeze