-
Notifications
You must be signed in to change notification settings - Fork 33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[subscriptions] Fix for Validating URLs #239
[subscriptions] Fix for Validating URLs #239
Conversation
Signed-off-by: hfuss <[email protected]>
Codecov Report
@@ Coverage Diff @@
## main #239 +/- ##
=======================================
Coverage 97.26% 97.26%
=======================================
Files 59 59
Lines 7521 7525 +4
=======================================
+ Hits 7315 7319 +4
Misses 163 163
Partials 43 43 |
We determined this occurs when if the Or bc we are parsing an invalid URL and ignoring the error: https://github.com/hyperledger/firefly-ethconnect/blob/main/internal/events/webhooks.go#L57 |
Signed-off-by: hfuss <[email protected]>
I've opted for handling this error as I believe this shouldn't be so optimistic since the subscription API does not validate the URL on creation / updates. Will defer adding such API validation for another time. This PR should be ready for review @peterbroadhurst @nguyer |
Signed-off-by: hfuss <[email protected]>
@@ -764,7 +764,8 @@ func (a *eventStream) performActionWithRetry(batchNumber uint64, events []*event | |||
func (a *eventStream) isAddressUnsafe(ip *net.IPAddr) bool { | |||
ip4 := ip.IP.To4() | |||
return !a.allowPrivateIPs && | |||
(ip4[0] == 0 || | |||
(len(ip4) < 1 || |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Safeguard to prevent panics and instead treat an empty addr as unsafe
@@ -114,3 +108,20 @@ func (w *webhookAction) attemptBatch(batchNumber, attempt uint64, events []*even | |||
} | |||
return err | |||
} | |||
|
|||
func (w *webhookAction) validateURL() (*url.URL, *net.IPAddr, error) { | |||
u, err := url.Parse(w.spec.URL) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We now handle this error to late validate if what was provided on the subscription is in fact a URL and not something like a hostname or arbitrary string
We've observed a webhook subscription can be configured with URL which resolves an empty address (without throwing earlier errors):
This is meant to treat this edge case then as an "unsafe address" so Ethconnect does not 1) panic and 2) the URL / hostname will be bubbled up as an error.