on master help sign in
Fix traverse bug in retryPendingForwards and block numeric IP addresses in SSRF checks
87be4d9iko
server.knot+3−3
@@ -318,7 +318,7 @@ isBadServerName = \s ->
318 || containsMultipleColons sn
318 || containsMultipleColons sn
319 || hasOctalOctet sn
319 || hasOctalOctet sn
320 || hasHexPrefix sn
320 || hasHexPrefix sn
321− || (isDigitChar (take 1 sn) && isAllDigitsUntilColonOrEnd sn)
321+ || (isDigitChar (take 1 sn) && isAllDigitsOrDotsUntilColonOrEnd sn)
322 || take 4 sn == "224." || take 4 sn == "225." || take 4 sn == "226." || take 4 sn == "227."
322 || take 4 sn == "224." || take 4 sn == "225." || take 4 sn == "226." || take 4 sn == "227."
323 || take 4 sn == "228." || take 4 sn == "229." || take 4 sn == "230." || take 4 sn == "231."
323 || take 4 sn == "228." || take 4 sn == "229." || take 4 sn == "230." || take 4 sn == "231."
324 || take 4 sn == "232." || take 4 sn == "233." || take 4 sn == "234." || take 4 sn == "235."
324 || take 4 sn == "232." || take 4 sn == "233." || take 4 sn == "234." || take 4 sn == "235."
@@ -529,9 +529,9 @@ retryForwardsForServer = \entries remaining ->
529
529
530retryPendingForwards : [{encryptedBlob: Text, fromKey: Text, messageId: Text, timestamp: Int, toKey: Text, toServer: Text}] -> IO {network} {}
530retryPendingForwards : [{encryptedBlob: Text, fromKey: Text, messageId: Text, timestamp: Int, toKey: Text, toServer: Text}] -> IO {network} {}
531retryPendingForwards = \pending -> do
531retryPendingForwards = \pending -> do
532− let servers = traverse (\x ->
532+ let servers = fold (\acc x ->
533 if count (do s <- acc; where s == x.toServer; yield s) > 0 then acc
533 if count (do s <- acc; where s == x.toServer; yield s) > 0 then acc
534− else union acc [x.toServer]) pending
534+ else union acc [x.toServer]) [] pending
535 sendToEach servers (\server ->
535 sendToEach servers (\server ->
536 retryForwardsForServer (do x <- pending; where x.toServer == server; yield x) maxForwardRetriesPerServer)
536 retryForwardsForServer (do x <- pending; where x.toServer == server; yield x) maxForwardRetriesPerServer)
537 yield {}
537 yield {}