Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
47,553 Commits 243 Branches 500 Tags 885 MiB
Commit Graph

3 Commits

Author SHA1 Message Date
Ted Johansson 06db264f24
FIX: Gracefully handle DNS issued from SSRF lookup when inline oneboxing (#19631) 
There is an issue where chat message processing breaks due to
unhandles `SocketError` exceptions originating in the SSRF check,
specifically in `FinalDestination::Resolver`.

This change gives `FinalDestination::SSRFDetector` a new error class
to wrap the `SocketError` in, and haves the `RetrieveTitle` class
handle that error gracefully.
 2022-12-28 10:30:20 +08:00
David Taylor f1ec8c869a
DEV: Fix FinalDestination::Resolver race condition (#19558) 
We were adding to the resolver's work queue before setting up the `@lookup` and `@parent` information. That could lead to the lookup being performed on the wrong (or `nil`) hostname. This also lead to some flakiness in specs.
 2022-12-21 16:02:24 +00:00
David Taylor 68b4fe4cf8
SECURITY: Expand and improve SSRF Protections (#18815) 
See https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr

Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
Co-authored-by: Daniel Waterworth <me@danielwaterworth.com>
 2022-11-01 16:33:17 +00:00