Merge pull request #71 from fruechel-canva/main

Add exclusion patterns for curl-unecrypted-url
trailofbits · Jan 6, 2025 · 1e3cf08 · 1e3cf08
2 parents 6b4738c + 072ce07
commit 1e3cf08
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/generic/curl-unencrypted-url.sh b/generic/curl-unencrypted-url.sh
@@ -13,4 +13,13 @@ curl https://google.com > /dev/null
 curl http://localhost > /dev/null
 
 # ok: curl-unencrypted-url
-curl http://127.0.0.1 > /dev/null
+curl http://127.0.0.1 > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://169.254.169.254 > /dev/null
+#
+# ok: curl-unencrypted-url
+curl http://[fd00:ec2::254] > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://metadata.google.internal > /dev/null
diff --git a/generic/curl-unencrypted-url.yaml b/generic/curl-unencrypted-url.yaml
@@ -19,3 +19,6 @@ rules:
           - pattern: curl ... ftp://
       - pattern-not-inside: curl ... http://127.0.0.1
       - pattern-not-inside: curl ... http://localhost
+      - pattern-not-inside: curl ... http://169.254.169.254
+      - pattern-not-inside: curl ... http://[fd00:ec2::254]
+      - pattern-not-inside: curl ... http://metadata.google.internal