GitHub Actions 5164ea82d1 fix(security): eliminate SSRF vulnerability in URL connectivity testing (CWE-918) ...

Resolves Critical severity CodeQL finding in url_testing.go by implementing
connection-time IP validation via custom DialContext. This eliminates TOCTOU
vulnerabilities and prevents DNS rebinding attacks.

Technical changes:
- Created ssrfSafeDialer() with atomic DNS resolution and IP validation
- Refactored TestURLConnectivity() to use secure http.Transport
- Added scheme validation (http/https only)
- Prevents access to 13+ blocked CIDR ranges (RFC 1918, cloud metadata, etc.)

Security impact:
- Prevents SSRF attacks (CWE-918)
- Blocks DNS rebinding
- Protects cloud metadata endpoints
- Validates redirect targets

Testing:
- All unit tests pass (88.0% coverage in utils package)
- Pre-commit hooks: passed
- Security scans: zero vulnerabilities
- CodeQL: Critical finding resolved

Refs: #450

2025-12-23 17:10:12 +00:00

..

implementation

test: add comprehensive frontend tests for Public URL and invite preview features

2025-12-23 16:32:19 +00:00

issues

feat(security): comprehensive SSRF protection implementation

2025-12-23 15:09:22 +00:00

plans

feat(security): comprehensive SSRF protection implementation

2025-12-23 15:09:22 +00:00

reports

fix(security): eliminate SSRF vulnerability in URL connectivity testing (CWE-918)

2025-12-23 17:10:12 +00:00

security

feat(security): comprehensive SSRF protection implementation

2025-12-23 15:09:22 +00:00

troubleshooting

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

acme-staging.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

AGENT_SKILLS_MIGRATION.md

feat: migrate scripts to Agent Skills following agentskills.io specification

2025-12-20 20:37:16 +00:00

api.md

feat(security): comprehensive SSRF protection implementation

2025-12-23 15:09:22 +00:00

beta_release_draft_pr_body_snapshot.md

fix: update workflows to use GITHUB_TOKEN instead of CHARON_TOKEN for improved compatibility

2025-12-14 00:11:06 +00:00

beta_release_draft_pr.md

fix: update workflows to use GITHUB_TOKEN instead of CHARON_TOKEN for improved compatibility

2025-12-14 00:11:06 +00:00

beta_release_pr_body.md

fix: update workflows to use GITHUB_TOKEN instead of CHARON_TOKEN for improved compatibility

2025-12-14 00:11:06 +00:00

cerberus.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

crowdsec-auto-start-quickref.md

fix(security): resolve CrowdSec startup and permission issues

2025-12-23 01:59:21 +00:00

database-maintenance.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

database-schema.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

debugging-local-container.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

features.md

fix(monitoring): resolve uptime port mismatch for non-standard ports

2025-12-23 03:28:45 +00:00

getting-started.md

fix(security): resolve CrowdSec startup and permission issues

2025-12-23 01:59:21 +00:00

github-setup.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

i18n-examples.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

import-guide.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

index.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

live-logs-guide.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

migration-guide-crowdsec-auto-start.md

fix(security): resolve CrowdSec startup and permission issues

2025-12-23 01:59:21 +00:00

migration-guide.md

chore: implement instruction compliance remediation

2025-12-21 04:08:42 +00:00

security-incident-response.md

Update docs/security-incident-response.md

2025-12-23 01:23:54 -05:00

security.md

feat(docs): add comprehensive container hardening configuration and validation steps

2025-12-23 06:52:19 +00:00