4ab767e3d4
TASK-009: Mitigate SSRF vulnerability in blocklist URL validation
...
- Change BlocklistSourceCreate.url from str to AnyHttpUrl (Pydantic type)
- Rejects non-http schemes (file://, ftp://, etc.) at model boundary
- Add is_private_ip() utility to detect RFC 1918 private ranges:
- 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC 1918)
- 127.0.0.0/8, ::1/128 (loopback)
- 169.254.0.0/16, fe80::/10 (link-local)
- IPv6 site-local, multicast, and reserved ranges
- Add async validate_blocklist_url() function:
- Resolves hostname via DNS using loop.run_in_executor()
- Rejects if hostname resolves to private/reserved IP
- Raises ValueError on validation failure
- Integrate validation into service layer:
- create_source() calls validate_blocklist_url() before persist
- update_source() conditionally validates if url provided
- Both raise ValueError on failure
- Update router endpoints with error handling:
- create_blocklist() and update_blocklist() catch ValueError
- Return HTTP 400 Bad Request with descriptive error message
- Add comprehensive test coverage (9 new SSRF tests):
- file://, ftp://, localhost, 127.0.0.1, 192.168.x.x
- 10.x.x.x, 172.16.x.x, 169.254.x.x (link-local)
- Valid public URLs (passes validation)
- All 36 service tests passing
- Update documentation:
- Features.md: Document URL validation constraints
- Backend-Development.md: Add SSRF prevention pattern section
Fixes SSRF vulnerability where authenticated users could supply
file://, ftp://, or private IP URLs and the backend would fetch them.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-04-26 12:57:23 +02:00
4b8af1d43a
Fix import formatting and sorting
...
Ruff formatting fixes for import organization.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-04-25 18:54:57 +02:00
1a3401f418
T-10: Fix get_geo_batch_lookup for proper injection with GeoCache instance
...
Instead of returning a bound method (geo_cache.lookup_batch), now inject
the GeoCache instance directly into routers and services. This provides
proper runtime isolation since T-04 made GeoCache a proper object.
Changes:
- Remove get_geo_batch_lookup() dependency provider
- Add GeoCacheDep type alias for injecting GeoCache instances
- Update all routers (bans, blocklist, dashboard, jails) to use GeoCacheDep
- Update ban_service, blocklist_service, jail_service to accept GeoCache
- Update service protocols to match new signatures
- Update docstrings to reference GeoCache methods instead of module functions
All callers now call geo_cache.lookup_batch(...) directly instead of
geo_batch_lookup(...), providing real dependency injection with proper
testing isolation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-04-25 18:53:47 +02:00
8c6950afc1
Task 13: move ban_ip, unban_ip, and get_active_bans from jail_service to ban_service and update routers/tests
2026-04-17 16:22:20 +02:00
7d16391c6c
Centralise DbDep and mark Task 11 complete
2026-04-17 15:44:13 +02:00
73cc212e28
Invert blocklist scheduler dependency to task callback
2026-04-15 21:31:08 +02:00
b70dc6fa7a
Refactor blocklist schedule management into service
2026-04-14 15:25:36 +02:00
56ade7fb08
Task 13: wire geo_batch_lookup through dependency injection and mark task completed
2026-04-14 09:51:23 +02:00
a564830abb
Fix blocklist service injection and centralize session cookie name
2026-04-14 09:21:38 +02:00
ed3aa61c35
Refactor routers to use explicit FastAPI app dependencies
2026-04-07 20:27:06 +02:00
594f55d157
Refactor router dependency wiring to explicit app state providers
2026-04-06 20:12:04 +02:00
f0ee466603
backup
2026-04-06 19:49:53 +02:00
bf2abda595
chore: commit local changes
2026-03-22 14:24:32 +01:00
a442836c5c
refactor: complete Task 2/3 geo decouple + exceptions centralization; mark as done
2026-03-22 14:24:25 +01:00
1ce5da9e23
Refactor blocklist log retrieval via service layer and add fail2ban DB repo
2026-03-22 14:24:24 +01:00
1efa0e973b
Stage 10: external blocklist importer — backend + frontend
...
- blocklist_repo.py: CRUD for blocklist_sources table
- import_log_repo.py: add/list/get-last log entries
- blocklist_service.py: source CRUD, preview, import (download/validate/ban),
import_all, schedule get/set/info
- blocklist_import.py: APScheduler task (hourly/daily/weekly schedule triggers)
- blocklist.py router: 9 endpoints (list/create/update/delete/preview/import/
schedule-get+put/log)
- blocklist.py models: ScheduleFrequency (StrEnum), ScheduleConfig, ScheduleInfo,
ImportSourceResult, ImportRunResult, PreviewResponse
- 59 new tests (18 repo + 19 service + 22 router); 374 total pass
- ruff clean, mypy clean for Stage 10 files
- types/blocklist.ts, api/blocklist.ts, hooks/useBlocklist.ts
- BlocklistsPage.tsx: source management, schedule picker, import log table
- Frontend tsc + ESLint clean
2026-03-01 15:33:24 +01:00
