discourse

Commit Graph

Author	SHA1	Message	Date
Ted Johansson	06db264f24	FIX: Gracefully handle DNS issued from SSRF lookup when inline oneboxing (#19631 ) There is an issue where chat message processing breaks due to unhandles `SocketError` exceptions originating in the SSRF check, specifically in `FinalDestination::Resolver`. This change gives `FinalDestination::SSRFDetector` a new error class to wrap the `SocketError` in, and haves the `RetrieveTitle` class handle that error gracefully.	2022-12-28 10:30:20 +08:00
David Taylor	68b4fe4cf8	SECURITY: Expand and improve SSRF Protections (#18815 ) See https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com> Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>	2022-11-01 16:33:17 +00:00

Author

SHA1

Message

Date

Ted Johansson

06db264f24

FIX: Gracefully handle DNS issued from SSRF lookup when inline oneboxing (#19631 )

There is an issue where chat message processing breaks due to
unhandles `SocketError` exceptions originating in the SSRF check,
specifically in `FinalDestination::Resolver`.

This change gives `FinalDestination::SSRFDetector` a new error class
to wrap the `SocketError` in, and haves the `RetrieveTitle` class
handle that error gracefully.

2022-12-28 10:30:20 +08:00

David Taylor

68b4fe4cf8

SECURITY: Expand and improve SSRF Protections (#18815 )

See https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr

Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>

2022-11-01 16:33:17 +00:00

2 Commits