Post

kopper
@w.on-t.work

ssrf protection being so underbaked in pretty much any toolkit is really disappointing and feels like some kind of indication of how little people cares about communicating with any machine not their own. "Just Allowlist Everyone In The Firewall 4Head" should not be The Solution

kopper
@w.on-t.work

iceshrimp.net is stuck using http/2 for the foreseeable future because dotnet's http/3 does not seem to expose the ability for us to create our own socket for the connection to go through, all just to validate that the IP we're connecting to is not local.

0 reposts1 like

kopper
@w.on-t.work

dns is not enough because you Can Just do `http://127.0.0.1`, and checking the domains ahead-of-time is obvious TOCTOU

kopper
@w.on-t.work

(triggered by the recent mastodon release which had a ssrf bypass involving a weird uncommon ipv6 feature, which is not unexpected when everyone's expected to build this from scratch. at least in dotnet we can check IpAddress.IsLoopback and friends and if that breaks it's not our bug)

kopper
@w.on-t.work

this mighe be solvable at a firewall layer, but that's another complication in deployment to go wrong / invisibly get ignored by people (or worse, "one click deployment") throwing a dockerfile at the wall

kopper
@w.on-t.work

activitypub does a lot of requests with zero in-protocol batching, so http/2 and /3 would actually be helpful if my model of how they work is accurate