mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-08-25 04:17:15 +00:00
Sanaei
2d30ab3ada
SanitizePublicHTTPURL rejected a hostname as soon as any single resolved
address was blocked, so a resolver returning a bogon AAAA for the test URL
host (e.g. 2001::1 for www.google.com, inside the Teredo range blocked
since b51f0976) failed the outbound Check button outright — including TCP
mode, which never uses the test URL. Mirror SSRFGuardedDialContext instead:
one usable address is enough, because the guarded dialer skips blocked
answers at connect time; a hostname with nothing usable is still refused.
Closes #6290
95 lines
2.4 KiB
Go
95 lines
2.4 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/util/netsafe"
|
|
)
|
|
|
|
// SanitizeHTTPURL validates and normalizes an http(s) URL without resolving
|
|
// DNS. Use SanitizePublicHTTPURL at the point of an outbound request.
|
|
func SanitizeHTTPURL(raw string) (string, error) {
|
|
raw = strings.TrimSpace(raw)
|
|
if raw == "" {
|
|
return "", nil
|
|
}
|
|
u, err := url.Parse(raw)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if u.Scheme != "http" && u.Scheme != "https" {
|
|
return "", fmt.Errorf("unsupported URL scheme %q", u.Scheme)
|
|
}
|
|
if u.Host == "" || u.Hostname() == "" {
|
|
return "", fmt.Errorf("URL host is required")
|
|
}
|
|
clean := &url.URL{
|
|
Scheme: u.Scheme,
|
|
Host: u.Host,
|
|
Path: u.Path,
|
|
RawPath: u.RawPath,
|
|
RawQuery: u.RawQuery,
|
|
Fragment: u.Fragment,
|
|
}
|
|
return clean.String(), nil
|
|
}
|
|
|
|
// SanitizePublicHTTPURL validates and normalizes an http(s) URL, then blocks
|
|
// private/internal targets unless the caller explicitly allows them.
|
|
func SanitizePublicHTTPURL(raw string, allowPrivate bool) (string, error) {
|
|
clean, err := SanitizeHTTPURL(raw)
|
|
if err != nil || clean == "" {
|
|
return clean, err
|
|
}
|
|
if allowPrivate {
|
|
return clean, nil
|
|
}
|
|
u, err := url.Parse(clean)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
if err := rejectPrivateHost(ctx, u.Hostname()); err != nil {
|
|
return "", err
|
|
}
|
|
return clean, nil
|
|
}
|
|
|
|
func rejectPrivateHost(ctx context.Context, hostname string) error {
|
|
if ip := net.ParseIP(hostname); ip != nil {
|
|
if isBlockedIP(ip) {
|
|
return fmt.Errorf("blocked private/internal address %s", ip.String())
|
|
}
|
|
return nil
|
|
}
|
|
ips, err := net.DefaultResolver.LookupIPAddr(ctx, hostname)
|
|
if err != nil {
|
|
return fmt.Errorf("cannot resolve host %s: %w", hostname, err)
|
|
}
|
|
return rejectAllBlockedIPs(hostname, ips)
|
|
}
|
|
|
|
// One usable address is enough — SSRFGuardedDialContext skips blocked ones at
|
|
// dial time, so a poisoned AAAA answer must not veto a healthy hostname.
|
|
func rejectAllBlockedIPs(hostname string, ips []net.IPAddr) error {
|
|
if len(ips) == 0 {
|
|
return fmt.Errorf("host %s has no IP addresses", hostname)
|
|
}
|
|
for _, ipAddr := range ips {
|
|
if !isBlockedIP(ipAddr.IP) {
|
|
return nil
|
|
}
|
|
}
|
|
return fmt.Errorf("host %s resolves to blocked private/internal address %s", hostname, ips[0].IP.String())
|
|
}
|
|
|
|
func isBlockedIP(ip net.IP) bool {
|
|
return netsafe.IsBlockedIP(ip)
|
|
}
|